bootstrap secret ' ' has invalid environment variable name

Error message

bootstrap secret '{name}' has invalid environment variable name '{env}'

What it means

Each bootstrap secret declaration names an environment variable that the resolved value will be written to. mise validates that this is a legal environment variable name; if not, the declaration is rejected so the value never silently fails to export.

Solutions

Change the secret's env field to a valid environment variable name (letters, digits, underscore, not starting with a digit)
Do not leave env empty; if using the options form, always set env explicitly
Rename with underscores where you used hyphens or spaces

Example fix

# before
[bootstrap.secrets.api_key]
env = "MY-API-KEY"
# after
[bootstrap.secrets.api_key]
env = "MY_API_KEY"

Defensive patterns

Strategy: validation

Validate before calling

fn valid_env_name(s: &str) -> bool {
    !s.is_empty()
        && s.chars().next().map(|c| c.is_ascii_alphabetic() || c == '_').unwrap_or(false)
        && s.chars().all(|c| c.is_ascii_alphanumeric() || c == '_')
}

Prevention

Use UPPER_SNAKE_CASE for env var names; never hyphens or spaces
Always set env explicitly in the options form of a secret declaration
Cross-check names against shell restrictions (bash/sh) on target platforms

When it happens

Trigger: declaration_from_toml parses a secret whose `env` option (or inline env form) is empty or contains characters invalid for environment variable names, such as spaces, hyphens, or leading digits.

Common situations: Writing env = "MY-KEY" (hyphens are invalid in most shells), leaving env empty in the Options form, or confusing the secret name with the env var name and copying a '-'-containing key into env.

Understand the failure class

Background: "is not a valid" / "Invalid ... value" environment variable errors: how libraries validate env vars and what to do when they reject yours — this error's family across 48 libraries.

Related errors

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/0d8948189b94411b. Report an issue: GitHub.

Appendix: source

Thrown at src/system/secrets.rs:436

    Ok(value)
}

fn declaration_from_toml(name: String, declaration: SecretTomlConfig) -> Result<SecretDeclaration> {
    if name.is_empty()
        || !name
            .chars()
            .all(|character| character.is_ascii_alphanumeric() || "_.-".contains(character))
    {
        bail!("invalid bootstrap secret name '{name}': use ASCII letters, digits, '.', '_' or '-'");
    }
    let (env, description, allow_empty) = match declaration {
        SecretTomlConfig::Env(env) => (env, None, false),
        SecretTomlConfig::Options(options) => {
            (options.env, options.description, options.allow_empty)
        }
    };
    if !valid_env_name(&env) {
        bail!("bootstrap secret '{name}' has invalid environment variable name '{env}'");
    }
    Ok(SecretDeclaration {
        name,
        env,
        description,
        allow_empty,
    })
}

fn valid_env_name(name: &str) -> bool {
    let mut characters = name.chars();
    characters
        .next()
        .is_some_and(|first| first == '_' || first.is_ascii_alphabetic())
        && characters.all(|character| character == '_' || character.is_ascii_alphanumeric())
}

fn env_state(declaration: &SecretDeclaration) -> SecretState {

View on GitHub (pinned to 533346cc37)