`doppler_secrets`

doppler_secrets returns a dependency that adds secrets from a Doppler project and config to the virtual environment of dependent tasks.

xx first calls the Doppler API with XX_DOPPLER_TOKEN from the host environment, then with a project-scoped XX_DOPPLER_TOKEN from the builtin secret manager. If neither token exists, xx uses an installed Doppler CLI and its existing login. It checks the CLI login before downloading secrets and does not install the CLI. Tokens are not added to the xx virtual environment or exposed to tasks.

The call fails if the Doppler CLI is installed but is not logged in. When the CLI is not installed, it fails if XX_DOPPLER_TOKEN is unset in both the host environment and builtin secret manager. To avoid exposing the token as a command-line argument, pipe it over standard input to xx secrets set XX_DOPPLER_TOKEN from the project directory.

Arguments

Argument	Required	Description
`project`	Yes	Doppler project name.
`config`	Yes	Doppler config name.
`filter`	No	Ordered list of secret names to include. Missing names are ignored, and the first occurrence of an exact duplicate wins. `None` includes all secrets in lexical name order. An empty list includes no secrets and does not contact Doppler. Defaults to `None`.

Secret names and values must be valid environment variables. In particular, names cannot contain = or NUL, and values cannot contain NUL.

Examples

Load selected secrets

load("@doppler@1", "doppler_secrets")
load("@os@1", "os_run")

secrets = doppler_secrets(
    project = "my-project",
    config = "prod",
    filter = ["DATABASE_URL", "API_KEY"],
)

os_run(("tools/deploy",), deps = [secrets])

Load all secrets

load("@doppler@1", "doppler_secrets")

prod_secrets = doppler_secrets("my-project", "prod")