Postman CLI secret commands `(postman secret)`

This topic covers secret-related commands for the Postman CLI.

Use the postman secret commands to manage secrets in your team’s Shared Vault from the command line. This supports secure credential management in your automation and CI workflows.

`postman secret create`

Creates one or more secrets in your team’s Shared Vault. Sign in with the postman login command or pass an --api-key, and target a team and a workspace.

By default, it opens a one-time browser form so you (or whoever is at the keyboard) can enter the value. The CLI only sees the secret names and the resulting IDs. This also lets you create several secrets in a single command, entering each value in the same form.

Once you submit the form, the browser tab shows each secret’s ID next to its name. It looks something like 12345678-90ab-cdef-1234-567890abcdef. Copy it from there, since you’ll need it later to link a variable to the secret with --secret-id. The CLI also prints the same ID to the terminal after the browser tab closes.

To enter a value in the terminal instead, pass --terminal, which prompts with a masked input for one secret name at a time. To supply the value in automation, pipe it through standard input with --value-stdin, which implies --terminal and also accepts one name at a time.

Usage

postman secret create <keys...> [options]

<keys...>

One or more keys for the new secrets. The default browser form accepts one or more names. The --terminal and --value-stdin options accept only one name, so passing more than one key requires the browser form.

Options

--team-id <id>

The ID of the team whose Shared Vault the secret is created in. Defaults to your authenticated profile’s team. This must be your own team.

-w, --workspace <workspaceId>

The Postman workspace ID. If omitted, the command uses the workspace bound to your local project by postman init.

--api-key <key>

Your Postman API key. If omitted, the command uses your postman login session.

--terminal

Enters the secret value through a masked terminal prompt instead of the default browser form. Takes one key.

--value-stdin

Reads the secret value from standard input instead of prompting for it. Implies --terminal, and takes one key. Use this in automation and CI pipelines.

--timeout <seconds>

How long to wait for the browser form to be submitted, in seconds. Defaults to 300. Has no effect with --terminal or --value-stdin.

Examples

# Opens a one-time browser form to enter the value.
postman secret create MY_SECRET --team-id 451 --workspace 12345678-90ab-cdef-1234-567890abcdef
# Creates several secrets from the same browser form.
postman secret create MY_SECRET OTHER_SECRET --team-id 451 --workspace 12345678-90ab-cdef-1234-567890abcdef
# Use a CI-injected variable so the raw secret stays out of your shell history.
printf '%s' "$MY_SECRET_VALUE" | postman secret create MY_SECRET --team-id 451 --value-stdin

`postman secret list`

Lists the secrets in a workspace’s Shared Vault, including each secret’s key, secret ID, vault ID, and allowed domains. The command never prints a secret’s value.

Pass a secret’s ID and vault ID to postman environment var set --secret-id --vault-id to link an environment variable to it. An empty allowed-domains list means the secret can be used with all domains.