pinset env set
Add or update a profile variable while saving only ciphertext in project files.
View source on GitHub ↗When to use
Use to add API tokens, database addresses or rotate values. Create a profile with env init first.
Examples
pinset env set API_TOKEN --profile dev
The API_TOKEN: prompt hides input. Results confirm only profile, variable and set, never the value. Inspect names with env list --profile dev.
Behavior
Reads and re-encrypts the profile, writing ciphertext and state transactionally without network access. Commit ciphertext/public authorization, never private identities. Toolchain and Pinset control variables are reserved. Process-variable conflicts also fail during execution.
Editing requires explicit owner_recipients. Older profiles remain readable. Maintainers must confirm public owners and grants so recipients equal their union, then renew trust. Private keys do not belong in configuration.
Parameters, exit codes and common errors
| Parameter | Meaning |
|---|---|
<name> | Variable name. |
--profile <profile> | Required target. |
--stdin | Read stdin, trimming trailing newlines; maximum 1 MiB. |
Success exits 0; failure exits 1. PINSET_ENV_INPUT_LIMIT means oversized input; PINSET_PROFILE_MISSING, no profile. Do not put secrets directly in command arguments or logs.