paperclipai/paperclip · error · Error

Deletion requires --confirm <secretId> matching the secret I

Error message

Deletion requires --confirm <secretId> matching the secret ID.

What it means

As the second confirmation for secret deletion, the action requires `--confirm <secretId>` to equal the `<secretId>` argument exactly. A mismatch (or omission, since `--confirm` has no default) throws. This typed-confirmation pattern prevents accidental deletion of the wrong secret by forcing the operator to retype the id.

Source

Thrown at cli/src/commands/client/secrets.ts:545

          printOutput(await ctx.api.get(apiPath`/api/secrets/${secretId}/access-events`), { json: ctx.json });
        } catch (err) {
          handleCommandError(err);
        }
      }),
  );

  addCommonClientOptions(
    secrets
      .command("delete")
      .description("Delete a secret")
      .argument("<secretId>", "Secret ID")
      .option("--yes", "Required safety flag to confirm destructive action", false)
      .option("--confirm <secretId>", "Repeat the secret ID to confirm deletion")
      .action(async (secretId: string, opts: SecretDeleteOptions) => {
        try {
          if (!opts.yes) throw new Error("Deletion requires --yes.");
          if (opts.confirm !== secretId) {
            throw new Error("Deletion requires --confirm <secretId> matching the secret ID.");
          }
          const ctx = resolveCommandContext(opts);
          printOutput(await ctx.api.delete(apiPath`/api/secrets/${secretId}`), { json: ctx.json });
        } catch (err) {
          handleCommandError(err);
        }
      }),
  );

  addCommonClientOptions(
    secrets
      .command("doctor")
      .description("Run secret provider health checks through the Paperclip API")
      .requiredOption("-C, --company-id <id>", "Company ID")
      .action(async (opts: SecretDoctorOptions) => {
        try {
          const ctx = resolveCommandContext(opts, { requireCompany: true });
          const health = await ctx.api.get<SecretProviderHealthResponse>(

View on GitHub (pinned to 67001ec6eb)

Solutions

1. Repeat the exact same secret id in both positions: `secrets delete <id> --yes --confirm <id>`
2. In scripts, use a single variable for both the argument and `--confirm`: `secrets delete "$SID" --yes --confirm "$SID"`
3. Double-check there are no extra spaces or quotes around the value

Example fix

# before
paperclipai secrets delete sec_01H --yes --confirm sec_02H
# after
paperclipai secrets delete sec_01H --yes --confirm sec_01H

function confirmMatches(secretId: string, confirm: string | undefined): boolean {
  return confirm === secretId;
}
if (!confirmMatches(secretId, opts.confirm)) {
  throw new Error(`--confirm must equal the secret id '${secretId}'`);
}

When it happens

Trigger: Running `paperclipai secrets delete sec_A --yes --confirm sec_B`; omitting `--confirm` entirely; a trailing/leading space or wrong-case value in `--confirm`.

Common situations: Copy-pasting a different secret id into `--confirm`; scripting that interpolates the wrong variable; case mismatch if ids are case-sensitive.

Related errors

• Deletion requires --yes.
• Environment variable ${envName} is empty or not set.
• Challenge secret is required. Pass --token or --token-env.
• Deletion requires --yes.
• Deletion requires --confirm <value> where value matches the

AI-assisted analysis of paperclipai/paperclip@67001ec6eb (2026-08-12). Data as JSON: /api/errors/a9e6b11e9ff2d412. Report an issue: GitHub.