Secrets

Apps need no insta-specific code. Credentials arrive as standard DATABASE_URL / AWS_* variables, injected at deploy time.

insta secrets --print                                # full bundle (gated)
insta secrets tree                                   # names-only project → branch → service binding tree
insta secrets set NAME=value                          # project-wide
insta secrets set NAME=value --branch <b>             # branch override
insta secrets set NAME=value --branch <b> --service <s>  # bound to one service; --service requires --branch

Reserved names are rejected. Writes are gated by secrets.write.

Get started

Concepts

Reference