| Point at an organization | secretsmgr configure --repo <url> --root-fingerprint <words> |
| Create your keypair | secretsmgr enroll request --name <you> --custody <type> |
| Approve someone | secretsmgr enroll approve <request> |
| Run an app with secrets | secretsmgr run --vault <v> -- <command> |
| Write a .env file | secretsmgr env --vault <v> --template <f> |
| Read one value | secretsmgr get <vault>/<path> |
| List a vault | secretsmgr list <vault> |
| Store a value | secretsmgr put <vault>/<path> < file |
| Give access | secretsmgr grant <vault> <principal> |
| Remove access | secretsmgr revoke <vault> <principal> |
| Offboard entirely | secretsmgr revoke-principal <principal> |
| Rotate your own keys | secretsmgr key rotate |
| Re-encrypt a vault | secretsmgr vault rotate-data-keys <vault> |
| Change a credential upstream | secretsmgr secret rotate <vault>/<path> (phase 4) |
| Recover from a lost key | secretsmgr recover |
| Check everything | secretsmgr doctor |
| Verify the repository | secretsmgr verify |
| Back up | secretsmgr repo mirror <url> |
| Who is holding file keys? | secretsmgr report file-custody |