Forward a local secret
Declare the name, then supply its value in your local environment or ignored.env file before deploying:
name is the variable the app sees. from names where its value comes from; without it, the value comes from name. A missing required value fails deployment before release submission. Use optional: true only if the application handles an absent value: an optional secret without a value is left out. Resolved secrets override matching env entries. Never paste actual credentials into documentation, command history, or source control.
Where values come from
The same declaration resolves in different places, depending on what deploys the app:
Each app is deployed by one of these at a time; see release ownership.
Generate an application credential
Credentials use a named map, not a list:envVar, the injected name is CRED_ADMIN_TOKEN. Incremental deployment requires generate: true; supply externally managed credentials through secrets or env. Keep environment names valid and distinct.
Deploy and verify
Runrig deploy --workspace my-project locally. Confirm the app accepts its credential through its normal authenticated flow. Do not print the value to prove injection succeeded.
If a GitHub connection deploys the workspace’s apps, rig deploy does not deploy them. It stores the values it resolved in the connection’s runtime secrets, for the names rig.yaml on the connected branch declares, reports which names it stored, and exits with an error saying that pushes deploy the apps. Push to the connected branch to deploy with the stored values. rig ci status lists which of each connection’s declared secrets have a value.
The secrets declaration prevents storing a value in rig.yaml; it does not make app environment metadata an encrypted vault. Authorized environment/API readers can access stored values. Rotate a disclosed credential and redeploy, then revoke the old value at its provider if applicable.