Read one secret from a SOPS file

Tue, 12 May 2026 00:00:00 +0000

sops -d prints the entire decrypted file. Most of the time you want exactly one value — and you don’t want it landing in shell history or a temp file. --extract does that.

# secret — print one key from a SOPS-encrypted YAML file.
# Usage: secret CODEBERG_TOKEN [path/to/secrets.enc.yaml]
secret() {
 local key="$1" file="${2:-secrets.enc.yaml}"
 sops -d --extract "[\"${key}\"]" "$file"
}

Use it inline so the plaintext never touches disk and an env var still wins:

Sops on buildx.sh

Read one secret from a SOPS file