# sops <Badge type="warning" text="experimental" />

mise reads encrypted secret files and makes values available as environment variables via `env._.file`.

- **Formats**: `.env.json`, `.env.yaml`, `.env.toml`
- **Encryption**: [sops](https://getsops.io), using the built-in age support or the external `sops` CLI

## Example

```json
{
  "AWS_ACCESS_KEY_ID": "AKIAIOSFODNN7EXAMPLE",
  "AWS_SECRET_ACCESS_KEY": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
}
```

```toml [mise.toml]
[env]
_.file = ".env.json"
```

mise will automatically decrypt the file if it is sops-encrypted.

## Encrypt with sops

:::: info
The default `sops.rops = true` implementation supports age-encrypted files. Set
`sops.rops = false` to use the external `sops` CLI for other key services and
methods supported by SOPS, such as AWS KMS, GCP KMS, Azure Key Vault, Vault,
and PGP.
::::

:::: warning
The external `sops` CLI does not currently support TOML input/output. mise can decrypt SOPS-encrypted `.env.toml` files only with the default `sops.rops = true` setting. If you set `sops.rops = false`, mise shells out to the `sops` CLI and encrypted TOML env files fail with a configuration error. Use `.env.json` or `.env.yaml` when you need the external CLI path.
::::

1. Install tools: `mise use -g sops age`

2. Generate an age key and note the public key:

```sh
age-keygen -o ~/.config/mise/age.txt
# Public key: <public key>
```

3. Encrypt the file:

```sh
sops encrypt -i --age "<public key>" .env.json
```

:::: tip
The `-i` overwrites the file. The encrypted file is safe to commit. Set `SOPS_AGE_KEY_FILE=~/.config/mise/age.txt` or `MISE_SOPS_AGE_KEY_FILE=~/.config/mise/age.txt` to decrypt/edit with sops.
::::

Age key files use the standard SOPS/age format: put one identity on each line.
Blank lines and lines beginning with `#` are ignored, and all identities are
tried when decrypting.

4. Reference it in config:

```toml
[env]
_.file = ".env.json"
```

Now `mise env` exposes the values.

## Environment Variables

mise supports both mise-specific environment variables and standard SOPS ones:

**Mise-specific variables (highest priority):**

- `MISE_SOPS_AGE_KEY` - Age private key content directly
- `MISE_SOPS_AGE_KEY_FILE` - Path to age private key file

**Standard SOPS variables (fallback):**

- `SOPS_AGE_KEY_FILE` - Path to age private key file
- `SOPS_AGE_KEY` - Age private key content directly

**Precedence order:**

1. `MISE_SOPS_AGE_KEY` (mise setting or env var, checked first)
2. `MISE_SOPS_AGE_KEY_FILE` or `sops.age_key_file` (mise setting or env var)
3. `SOPS_AGE_KEY_FILE` (standard)
4. `SOPS_AGE_KEY` (standard, direct key content)
5. Default: `~/.config/mise/age.txt`

This allows you to override SOPS settings specifically for mise while keeping your standard SOPS configuration intact for other tools.

## Redaction

Mark secrets from files as sensitive:

```toml
[env]
_.file = { path = ".env.json", redact = true }
```

Work with redacted values:

```bash
mise env --redacted
mise env --redacted --values
```

### CI masking (GitHub Actions)

```yaml
- name: Mask secrets
  run: |
    for value in $(mise env --redacted --values); do
      echo "::add-mask::$value"
    done
- name: Use secrets safely
  run: |
    mise exec -- ./deploy.sh
```

If you use [mise-action](https://github.com/jdx/mise-action), values marked `redact = true` are masked automatically.

## Settings

<script setup>
import Settings from '/components/settings.vue';
</script>
<Settings child="sops" :level="2" />
