mise-en-place

Appearance

SOPS files ​

Commit a SOPS-encrypted .env.json, .env.yaml or .env.toml file and load it with env._.file. mise decrypts it each time it loads the environment.

Encrypt a file and load it ​

This walkthrough uses an age key, which mise can decrypt without the sops CLI.

1. Install the tools ​

sh
mise use -g sops age

2. Create an age key ​

Reuse an existing age identity, or create one:

sh
mkdir -p ~/.config/mise
mise exec -- age-keygen -o ~/.config/mise/age.txt
# Public key: age1...

Keep age.txt outside the repository.

3. Encrypt a file ​

Create .env.json with your values. This example uses a placeholder:

.env.json
json
{
  "API_TOKEN": "replace-with-your-token"
}

Encrypt it with the public key that age-keygen printed:

sh
mise exec -- sops encrypt -i --age "age1..." .env.json

-i replaces the plaintext file with ciphertext. Commit the encrypted file. To edit it later, point the sops CLI at the key; it reads SOPS_AGE_KEY_FILE, not the MISE_ variables:

sh
SOPS_AGE_KEY_FILE="$HOME/.config/mise/age.txt" mise exec -- sops .env.json

4. Load it ​

mise.toml
[env]
_.file = { path = ".env.json", redact = true }

mise now decrypts the file for mise exec, tasks and activated shells. Check that the value arrives without printing it:

sh
mise exec -- sh -c 'test -n "$API_TOKEN" && echo "API_TOKEN is set"'

redact = true keeps the values out of task output, but mise env still prints them. See Redaction and CI masking.

Choose a decryption method ​

mise decrypts age-encrypted SOPS files itself, so the sops CLI is not needed at runtime. For AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault or PGP, install the sops CLI, sign in to the provider, and set sops.rops = false so mise runs sops decrypt instead. mise looks for sops in the project's tools first, then on PATH.

The sops CLI cannot read TOML. With sops.rops = false, use .env.json or .env.yaml; an encrypted .env.toml fails with an error.

By default, mise stops with an error when it cannot decrypt a file, for example when no key is found, the key is wrong, or the sops CLI is missing. Set sops.strict = false to skip the file and continue instead.

Where mise finds the age key ​

mise uses the first of these that is set:

  1. MISE_SOPS_AGE_KEY, or the sops.age_key setting: the key itself
  2. MISE_SOPS_AGE_KEY_FILE, or the sops.age_key_file setting: a key file
  3. SOPS_AGE_KEY_FILE: a key file
  4. SOPS_AGE_KEY: the key itself
  5. ~/.config/mise/age.txt

The MISE_ variables let you give mise a different key without changing the SOPS configuration that other tools use.

These variables can also come from [env], as long as they appear before the encrypted file. The settings, including their MISE_ variables set in your shell, still take precedence:

mise.toml
[env]
MISE_SOPS_AGE_KEY_FILE = "~/age.txt"
_.file = ".env.yaml"

A key file can hold several identities, one per line. mise ignores blank lines and lines that start with #, and tries each identity.

Share with a team ​

Encrypt to each team member's public key, for example sops encrypt -i --age "age1...,age1..." .env.json, or add a .sops.yaml file with creation rules so sops picks the recipients itself. See the SOPS documentation.

Settings ​

Set these under [settings] in a config file, with mise settings set, or with a setting's environment variable where it has one. See which value wins when a setting is set in more than one place.

sops.age_key

Private age key for decrypting SOPS files, used before any other key source.

  • Type: string
  • Default: unset
  • Environment variable: MISE_SOPS_AGE_KEY

Prefer the MISE_SOPS_AGE_KEY environment variable to writing a private key into a config file. See Where mise finds the age key.

sops.age_key_file

Path of an age key file for decrypting SOPS files, used after sops.age_key and before SOPS_AGE_KEY_FILE.

  • Type: path
  • Default: unset
  • Environment variable: MISE_SOPS_AGE_KEY_FILE

When neither this nor sops.age_key is set, mise tries SOPS_AGE_KEY_FILE, SOPS_AGE_KEY and then ~/.config/mise/age.txt. See Where mise finds the age key.

sops.rops

Decrypt SOPS files with mise's built-in rops library instead of the sops CLI.

  • Type: boolean
  • Default: true
  • Environment variable: MISE_SOPS_ROPS

rops handles age keys. Set to false to run sops decrypt instead, for AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault or PGP keys. The CLI is slower and cannot read TOML, so an encrypted .env.toml needs rops. See Choose a decryption method.

sops.strict

Fail when a SOPS file cannot be decrypted, instead of skipping it.

  • Type: boolean
  • Default: true
  • Environment variable: MISE_SOPS_STRICT

Decryption fails when no age key is found, the key cannot decrypt the file, or the sops CLI is missing. Set to false to skip the file and continue.

MIT LicenseCopyright © 2026jdx.dev