lazysecrets/docs/integration.md

Integration

lazysecrets works outside its own window too: lazysecrets get reads a value for scripts, and lazysecrets list lists everything for fzf, editor pickers and your own tools. Both take the links lazysecrets copies and shares. For Neovim, there's lazysecrets.nvim.

Reading a value

lazysecrets get <link> prints the value, for scripts and pipes:

export DB_PASSWORD=$(lazysecrets get lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password)
lazysecrets get lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password | kubectl create secret generic db --from-file=password=/dev/stdin

It reads the value directly, with your az accounts (the one that last read it first), the Databricks profile for the workspace, or sops in your clone of the repo; a version in the link reads that version. --account tries that account first, as list prints it. The value ends with a newline only on a terminal.

Listing, for fzf and pickers

lazysecrets list prints every source, vault and secret, one per line, tab-separated:

Field
kind	source, vault, secret, key or certificate
name	platform-prod / kv-app-prod / db-password
account	what it's listed through: an az account (Azure:<user>/<tenant>), Databricks or Repos
link	its lazysecrets:// link

It's what Go to searches, so fzf, or an editor's picker, can search it instead, showing the names and acting on the links:

lazysecrets list | fzf --ansi --with-nth='2..-3' --accept-nth=-1 \
  --header 'enter: link · ctrl-o: open · ctrl-y: copy value · ctrl-x: copy and close' \
  --bind 'ctrl-o:become(lazysecrets open --action go --account {-2} {-1})' \
  --bind 'ctrl-y:execute-silent(lazysecrets get --account {-2} {-1} | pbcopy)+change-header(Copied the value of {2..-3})' \
  --bind 'ctrl-x:become(lazysecrets get --account {-2} {-1} | pbcopy)'

--with-nth='2..-3' shows and searches only the names; {-1} and --accept-nth=-1 are the link, {-2} the account. All but the name are one word, so this works without --delimiter. To filter by kind yourself: awk -F'\t' '$1 == "secret"'.

enter prints the link (lazysecrets get $(…)), ctrl-o opens it in lazysecrets, ctrl-y copies the value, saying so in the header, and ctrl-x copies it and closes fzf (pbcopy on macOS; wl-copy or xclip on Linux). A value copied this way isn't cleared from the clipboard after values.clipboardClear, as one copied in lazysecrets is.

--account makes open and get use the account it was listed through, when several of yours can see it: without, open asks which, and get tries the one that last read it first. The link stays as it is, to copy and share; the account isn't part of it. --action tells open what to do rather than asking, as it does for a link clicked elsewhere: go to it, copy its value too, or show it. It ends in the secrets list, like Go to, rather than on the details as a clicked link does.

What's cached prints at once. Then, like Go to, it loads what's missing or older than --max-age (2m), and what's new in it follows as it arrives: fzf shows it while you type. --cached loads nothing from Azure or Databricks, for an answer at once. Repos are always read, from disk. What it loads is cached for the TUI too. It stops when the reader goes, after a pick in fzf.

--kind lists only some kinds, comma-separated: source, vault (also Databricks scopes and repo files), secret, key, certificate. Lists only other kinds need aren't loaded: --kind source,vault asks for no secrets. Keys and certificates load only when asked for this way; else, like Go to, they're listed as far as you opened them in lazysecrets.

A vault or source it can't read is a line too, as it fails: its name, then ✗ and why in red (errorColor), with its link, so opening it shows more. They're in the list, not on stderr, which would draw over fzf. --errors=false leaves them out.

The name is coloured from your theme, with the provider's icon when icons are on (ui.icons); fzf shows the colours with --ansi. --color never leaves them out, for scripts, and --icons=false the icons. The link is never coloured.

--format json prints an object per line instead, for editor plugins, without colours or icons, and with error on a list it couldn't read:

{"link":"lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password","kind":"secret","provider":"azure","path":["platform-prod","kv-app-prod","db-password"],"account":"Azure:alice@example.com/<tenant>","accountLabel":"alice"}

accountLabel, the account's short name, is there when several az accounts are signed in. Values are never listed.