sops experimental

mise reads encrypted secret files and makes values available as environment variables via env._.file.

• Formats: .env.json, .env.yaml, .env.toml
• Encryption: sops, using the built-in age support or the external sops CLI

Example

{
  "AWS_ACCESS_KEY_ID": "AKIAIOSFODNN7EXAMPLE",
  "AWS_SECRET_ACCESS_KEY": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
}

mise.toml

[env]
_.file = ".env.json"

mise will automatically decrypt the file if it is sops-encrypted.

Encrypt with sops

INFO

The default sops.rops = true implementation supports age-encrypted files. Set sops.rops = false to use the external sops CLI for other key services and methods supported by SOPS, such as AWS KMS, GCP KMS, Azure Key Vault, Vault, and PGP.

WARNING

The external sops CLI does not currently support TOML input/output. mise can decrypt SOPS-encrypted .env.toml files only with the default sops.rops = true setting. If you set sops.rops = false, mise shells out to the sops CLI and encrypted TOML env files fail with a configuration error. Use .env.json or .env.yaml when you need the external CLI path.

1. Install tools: mise use -g sops age

2. Generate an age key and note the public key:

age-keygen -o ~/.config/mise/age.txt
# Public key: <public key>

3. Encrypt the file:

sops encrypt -i --age "<public key>" .env.json

TIP

The -i overwrites the file. The encrypted file is safe to commit. Set SOPS_AGE_KEY_FILE=~/.config/mise/age.txt or MISE_SOPS_AGE_KEY_FILE=~/.config/mise/age.txt to decrypt/edit with sops.

Age key files use the standard SOPS/age format: put one identity on each line. Blank lines and lines beginning with # are ignored, and all identities are tried when decrypting.

4. Reference it in config:

[env]
_.file = ".env.json"

Now mise env exposes the values.

Environment Variables

mise supports both mise-specific environment variables and standard SOPS ones:

Mise-specific variables (highest priority):

• MISE_SOPS_AGE_KEY - Age private key content directly
• MISE_SOPS_AGE_KEY_FILE - Path to age private key file

Standard SOPS variables (fallback):

• SOPS_AGE_KEY_FILE - Path to age private key file
• SOPS_AGE_KEY - Age private key content directly

Precedence order:

1. MISE_SOPS_AGE_KEY (mise setting or env var, checked first)
2. MISE_SOPS_AGE_KEY_FILE or sops.age_key_file (mise setting or env var)
3. SOPS_AGE_KEY_FILE (standard)
4. SOPS_AGE_KEY (standard, direct key content)
5. Default: ~/.config/mise/age.txt

This allows you to override SOPS settings specifically for mise while keeping your standard SOPS configuration intact for other tools.

Redaction

Mark secrets from files as sensitive:

[env]
_.file = { path = ".env.json", redact = true }

Work with redacted values:

mise env --redacted
mise env --redacted --values

CI masking (GitHub Actions)

- name: Mask secrets
  run: |
    for value in $(mise env --redacted --values); do
      echo "::add-mask::$value"
    done
- name: Use secrets safely
  run: |
    mise exec -- ./deploy.sh

If you use mise-action, values marked redact = true are masked automatically.

Settings

sops.age_key

• Type: string(optional)
• Env: MISE_SOPS_AGE_KEY
• Default: None

The age private key to use for sops secret decryption. Takes precedence over standard SOPS_AGE_KEY environment variable.

sops.age_key_file

• Type: string
• Env: MISE_SOPS_AGE_KEY_FILE
• Default: ~/.config/mise/age.txt

Path to the age private key file for sops secret decryption. Takes precedence over standard SOPS_AGE_KEY_FILE environment variable.

sops.age_recipients

• Type: string(optional)
• Env: MISE_SOPS_AGE_RECIPIENTS
• Default: None

The age public keys to use for sops secret encryption.

sops.rops

• Type: boolean
• Env: MISE_SOPS_ROPS
• Default: true

Use rops to decrypt sops files. Disable to shell out to sops which will slow down mise but sops may offer features not available in rops. Required for TOML SOPS files because the sops CLI does not support TOML.

sops.strict

• Type: boolean
• Env: MISE_SOPS_STRICT
• Default: true

If true, fail when sops decryption fails (including when sops is not available, the key is missing, or the key is invalid). If false, skip decryption and continue in these cases.