Skip to content
turnoutturnout

pass

Terminal window
turnout pass <set|copy|list|remove> [...]

A secret belongs to a credential. The credential holds the metadata - who logs in, and how it proves itself - while the value itself lives only in the OS keyring: Windows Credential Manager, macOS Keychain or Linux Secret Service. Secrets are never written to config files and never printed unless you explicitly ask.

Every subcommand takes a credential name, or offers a picker when you omit it.

set

Section titled “set”
Terminal window
turnout pass set [CREDENTIAL]

Interactively: type the secret twice (hidden input). For an auth = key credential the prompt asks for the key’s passphrase instead, which is what the secret means there.

An auth = agent credential has no secret to store and set refuses it: the passphrase was given to the SSH agent, which is the whole point of using one. Add the key there with ssh-add instead.

In scripts, pipe the secret via stdin so it never lands in shell history:

Terminal window
echo "$SECRET" | turnout pass set prod-deploy

Running set again replaces the stored value.

copy

Section titled “copy”
Terminal window
turnout pass copy [CREDENTIAL] [--user] [--show]
Flag Short Description
--user -u Copy the user name instead of the secret
--show -s Print to stdout instead of copying to the clipboard

Copies the secret to the clipboard and prints only a confirmation. --show prints the value to stdout instead - an explicit opt-in for terminals without a clipboard (e.g. over SSH).

Terminal window
turnout pass copy prod-deploy          # secret -> clipboard
turnout pass copy prod-deploy --user   # user    -> clipboard
turnout pass copy prod-deploy -s       # print the secret to stdout

list

Section titled “list”
Terminal window
turnout pass list

One line per credential: name, user, auth kind, and whether a secret is stored. Never the secrets themselves.

--json prints the same array as turnout credential list --json: one shape for both, with secret_stored saying whether the keyring holds a secret.

remove

Section titled “remove”
Terminal window
turnout pass remove [CREDENTIAL] [--yes]

Deletes the secret from the keyring. The credential itself stays - rotating a password should not cost you the account. Use turnout credential remove to drop both.