# atmos secret push

Upload secret values from a local `.env` or JSON file to the configured backend. Every key in the file **must** be declared for the stack and component — `push` fails on the first undeclared key and writes nothing. Use [`import`](/cli/commands/secret/import) instead if you want undeclared keys to be warned about and skipped rather than treated as a hard error.

## Usage

```shell
atmos secret push [flags]
```

Without `--component`, every key in the file must be a stack-scoped or global secret; instance-scoped secrets are never written. Their declarations must agree across components, otherwise `--component` is required. See [Secret scopes](/cli/commands/secret/usage#secret-scopes).

## Examples

```shell
# Push values from the default .env file
atmos secret push --stack=prod --component=api

# Only the stack-scoped and global secrets, no component
atmos secret push --stack=prod --input=shared.env

# Push values from a specific file
atmos secret push --stack=prod --component=api --input=secrets.env

# Push values from a JSON file
atmos secret push --stack=prod --component=api --format=json --input=secrets.json

# Push values piped in from standard input
cat secrets.env | atmos secret push --stack=prod --component=api --input=-
```

## Arguments

- **n/a** — No positional arguments.

## Flags

- **`--stack` (alias `-s`)** — The Atmos stack to operate on. **Required.**

  **Environment variable:** `ATMOS_STACK`
- **`--component` (alias `-c`)** — The Atmos component whose declared secrets receive the values. Omit it to write only the stack's stack-scoped and global secrets (see [Secret scopes](/cli/commands/secret/usage#secret-scopes)); **required** for instance-scoped secrets.

  **Environment variable:** `ATMOS_COMPONENT`
- **`--type`** — The component type (`terraform`, `helmfile`, `packer`, or `ansible`). Used to disambiguate when a component name exists in more than one type.
- **`--identity` (alias `-i`)** — The identity to use when accessing the secret backend.

  **Environment variable:** `ATMOS_IDENTITY`
- **`--input`** — The input file to read secret values from. Defaults to `.env`. Use `-` to read from standard input.
- **`--format`** — The input format: `env` or `json`. Defaults to `env`.

:::note Strict by design
Unlike [`import`](/cli/commands/secret/import), `push` requires every key in the input file to be declared. It fails on the first undeclared key so that nothing unexpected is written to the backend.
:::

## See Also

- [atmos secret](/cli/commands/secret/usage) — Overview of the secret command group
- [`!secret` YAML function](/functions/yaml/secret) — Resolve declared secrets at runtime