Secrets

Choose how to supply secret values to the project. mise passes resolved values to commands as environment variables; the secret provider or encryption key controls who can resolve them.

Approach	Store in the repository	Required at runtime
fnox (recommended)	Secret references or encrypted values managed by fnox	fnox and access to its configured providers
sops (experimental)	An encrypted JSON, YAML, or TOML file	A decryption identity; the SOPS CLI for providers outside built-in age support
Direct age encryption (experimental)	Individual encrypted values inside mise.toml	An age or SSH decryption identity

Use a secret manager

With fnox configured for the project and authenticated to its providers, run:

fnox exec -- mise run deploy

Replace deploy with your task. fnox resolves secrets before starting mise, so mise templates and tasks can read them from the inherited environment. fnox supports remote secret storage, such as 1Password and AWS Secrets Manager, and remote encryption, such as AWS KMS. See the fnox documentation for provider setup.

Bootstrap secret inputs give provisioning templates stable names while fnox handles providers and authentication.

Encrypt repository files or values

Use sops when secrets belong in a separate file, or direct age values when a few encrypted variables should live beside the rest of mise.toml. Commit the ciphertext and distribute decryption identities separately.

Encryption protects stored values. Redaction masks captured task output, and CI masking protects logs outside mise's output capture. mise env intentionally exports plaintext values, including those marked as redacted.