hermes secrets Command — Complete Reference & Examples

Overview

hermes secrets pulls API keys from an external secret manager at process startup instead of storing them in ~/.hermes/.env. It supports Bitwarden Secrets Manager and 1Password. See the secrets user guide for setup details.

hermes secrets {bitwarden|bw|onepassword|op|1password}

Subcommands

bitwarden (bw)

Manage the Bitwarden Secrets Manager integration.

hermes secrets bitwarden setup      # Interactive wizard
hermes secrets bitwarden install    # Download the pinned bws binary (v2.0.0)
hermes secrets bitwarden status     # Show config + token validation
hermes secrets bitwarden token      # Rotate the access token
hermes secrets bitwarden sync       # Fetch secrets now
hermes secrets bitwarden disable    # Turn off integration

onepassword (op, 1password)

Manage the 1Password integration via op:// references.

hermes secrets onepassword setup              # Verify op CLI and enable
hermes secrets onepassword status             # Show config + references
hermes secrets onepassword token              # Rotate service-account token
hermes secrets onepassword set VAR ref        # Map an env var to op:// reference
hermes secrets onepassword remove VAR         # Remove a mapping
hermes secrets onepassword sync               # Resolve references now
hermes secrets onepassword disable            # Turn off integration

Common Scenarios

Using Bitwarden Secrets Manager

hermes secrets bitwarden setup
hermes secrets bitwarden sync

Mapping a 1Password secret

hermes secrets onepassword set OPENAI_API_KEY op://vault/openai/credential
hermes secrets onepassword sync

Rotating a token

hermes secrets bitwarden token
# or
hermes secrets onepassword token

Checking status

hermes secrets bw status
hermes secrets op status

Tips

• Secrets are resolved at process startup, so credentials never need to be stored in ~/.hermes/.env.
• Use the provider’s install or setup subcommand to install required CLIs (bws or op).
• status validates the token and shows whether the integration is ready.
• Run sync after adding or rotating secrets in the vault.