# atmos secret delete

Remove a declared secret's value from its configured backend. Atmos prompts for confirmation before deleting unless you pass `--force`. The secret declaration in your stack configuration is not modified — only the stored value is removed. Pass `--all` to clear every declared secret for the scope (a clean, in-process reset of a SOPS file). This command is also available under the `rm` and `unset` aliases.

## Usage

```shell
atmos secret delete NAME [flags]
atmos secret delete --all [flags]
```

Deleting is **scope-aware**. For a named stack-scoped secret or a secret declared with `scope: global`, you may omit `--component`; with `--all`, only the stack's stack-scoped and global secrets are deleted. Atmos verifies that the declaration and provider agree across components, and asks for `--component` when they do not or when the secret is instance-scoped. See [Secret scopes](/cli/commands/secret/usage#secret-scopes).

`--all` cannot be combined with a `NAME`. A global secret is one value shared by every stack that uses its backend, so deleting it (by name or with `--all`) removes it for all of those stacks, not only the selected one.

## Examples

```shell
# Delete a secret value, prompting for confirmation
atmos secret delete DATADOG_API_KEY --stack=prod --component=api

# A stack-scoped or global secret does not require a component
atmos secret delete SHARED_API_KEY --stack=prod

# Delete without a confirmation prompt
atmos secret delete DATADOG_API_KEY --stack=prod --component=api --force

# Clear ALL declared secrets for the scope (resets a SOPS file to a clean state)
atmos secret delete --all --force --stack=prod --component=api

# Use the `rm` alias
atmos secret rm DATADOG_API_KEY --stack=prod --component=api

# Use the `unset` alias
atmos secret unset DATADOG_API_KEY --stack=prod --component=api

# Delete using a specific identity for the backend
atmos secret delete DATADOG_API_KEY --stack=prod --component=api --identity=aws/prod-secrets
```

## Arguments

- **`NAME`** — The name of the declared secret whose value is removed.

## Flags

- **`--stack` (alias `-s`)** — The Atmos stack to operate on. **Required.**

  **Environment variable:** `ATMOS_STACK`
- **`--component` (alias `-c`)** — The Atmos component that declares the secret. Optional for stack-scoped and global secrets (see [Secret scopes](/cli/commands/secret/usage#secret-scopes)); **required** for instance-scoped secrets.

  **Environment variable:** `ATMOS_COMPONENT`
- **`--type`** — The component type (`terraform`, `helmfile`, `packer`, or `ansible`). Used to disambiguate when a component name exists in more than one type.
- **`--identity` (alias `-i`)** — The identity to use when accessing the secret backend.

  **Environment variable:** `ATMOS_IDENTITY`
- **`--force` (alias `-f`)** — Delete the value without prompting for confirmation. Required when there is no interactive terminal (CI, pipes, scripts); without it the command fails with an `interactive mode not available` error that hints at `--force`.
- **`--all`** — Delete every declared secret's value for the scope instead of a single `NAME`. For a SOPS file this resets it to a clean state in-process. The `NAME` argument is omitted when `--all` is used.

## See Also

- [atmos secret](/cli/commands/secret/usage) — Overview of the secret command group
- [`!secret` YAML function](/functions/yaml/secret) — Resolve declared secrets at runtime