---
title: "oz0 server secrets-key wrap"
description: "Move the secrets key under a key command, which keeps the key that wraps it in an HSM, a KMS or anything else."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/server/secrets-key/wrap"
---
# oz0 server secrets-key wrap

> Move the secrets key under a key command, which keeps the key that wraps it in an HSM, a KMS or anything else.

For: Operators and developers looking up a command.

Move the secrets key under a key command, which keeps the key that wraps it in an HSM, a KMS or anything else. It wraps the key with `COMMAND wrap`, checks that `COMMAND unwrap` gives the same key back, keeps the plain file as \<file>.plain and writes the wrapped document in its place. Start every server with --secrets-key-command COMMAND from then on.

Once they run, shred the plain copy with --forget-plain --confirm-backup (after you have an offline copy of the key, as `server init` asks for).

--rewrap rotates the wrapping key of a file that is wrapped already: it unwraps with --from-command (default --command) and wraps the same key with --command, keeping the old document as \<file>.prev. Use it for a new KMS key, alias, endpoint or credentials. The key itself does not change.

Run it on a server's machine, with the key file the servers use. With --db-file, OZ0_DB or --dev it also checks the key against the cluster and writes an audit entry; an edge apart from management runs it without. It needs no licence: `unwrap-to-file` is the way back to a plain file.

## Usage

```bash
oz0 server secrets-key wrap --command COMMAND [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --command
      </code>
    </td>
    
    <td>
      command
    </td>
    
    <td>
      
    </td>
    
    <td>
      the key command that wraps the key from now on
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --confirm-backup
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --forget-plain: an offline copy of the key exists, apart from the database's backups (recorded as confirm-backup does, with the database)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --data-dir
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        ~/.local/share/orchestrator-zero
      </code>
    </td>
    
    <td>
      server data directory
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --db-file
      </code>
    </td>
    
    <td>
      file
    </td>
    
    <td>
      
    </td>
    
    <td>
      a file (- for stdin) holding the PostgreSQL URL of the management database, such as postgres://oz0:PASSWORD@db:5432/oz0 (or set OZ0_DB); the URL can carry a password, so it never goes on the command line
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --dev
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      a dev server's data directory (--data-dir) instead of a cluster's database
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --forget-plain
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      shred &lt;file>.plain, the plain copy wrap kept, once the wrapped file unwraps to the same key
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --from-command
      </code>
    </td>
    
    <td>
      command
    </td>
    
    <td>
      <code>
        --command
      </code>
    </td>
    
    <td>
      with --rewrap: the key command that unwraps the file now
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --note
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --forget-plain: where the offline copy is kept, one line for the audit log; never the key
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --rewrap
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      rotate the wrapping key of a file that is wrapped already
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --secrets-key-file
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the secrets key file the edges start with (--secrets-key-file of server start)
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.