paperclipai/paperclip · error · Error

Invalid --secret-value "${raw}". Use key=value.

Error message

Invalid --secret-value "${raw}". Use key=value.

What it means

Thrown by parseSecretValues() when a --secret-value value, after splitting on '=' and trimming, yields an empty key. Used by `teams install` to supply secret env values. Notably only the key is required — an empty value is accepted by this check. As with --name-override, a missing '=' is caught earlier by parseKeyValueOption; this throw is for a '=' present but a blank/whitespace key.

Source

Thrown at cli/src/commands/client/teams.ts:493

  if (!values || values.length === 0) return undefined;
  const result: Record<string, string> = {};
  for (const raw of values) {
    const [slug, name] = parseKeyValueOption(raw, "--name-override", "slug=name");
    if (!slug || !name) {
      throw new Error(`Invalid --name-override "${raw}". Use slug=name.`);
    }
    result[slug] = name;
  }
  return result;
}

function parseSecretValues(values: string[] | undefined): Record<string, string> | undefined {
  if (!values || values.length === 0) return undefined;
  const result: Record<string, string> = {};
  for (const raw of values) {
    const [key, value] = parseKeyValueOption(raw, "--secret-value", "key=value");
    if (!key) {
      throw new Error(`Invalid --secret-value "${raw}". Use key=value.`);
    }
    result[key] = value;
  }
  return result;
}

function parseAdapterOverrides(
  values: string[] | undefined,
): CatalogTeamInstallOptions["adapterOverrides"] | undefined {
  if (!values || values.length === 0) return undefined;
  const result: NonNullable<CatalogTeamInstallOptions["adapterOverrides"]> = {};
  for (const raw of values) {
    const [slug, adapterType] = parseKeyValueOption(raw, "--adapter-override", "slug=type");
    if (!slug || !adapterType) {
      throw new Error(`Invalid --adapter-override "${raw}". Use slug=type.`);
    }
    result[slug] = { adapterType };
  }

View on GitHub (pinned to 67001ec6eb)

Solutions

1. Format as `--secret-value <key>=<value>` with a non-empty key, e.g. `--secret-value API_KEY=sk-...`.
2. If you intended an empty value, still supply a real key: `--secret-value MY_KEY=` is valid.
3. Validate each entry has a non-empty trimmed key before invoking.

Example fix

# before
paperclipai teams install <ref> --secret-value =sk-live
# after
paperclipai teams install <ref> --secret-value API_KEY=sk-live

function validSecretValue(v: string): boolean {
  const i = v.indexOf("=");
  if (i <= 0) return false;
  return v.slice(0, i).trim().length > 0; // value may be empty
}
for (const v of secretValues) {
  if (!validSecretValue(v)) throw new Error(`Bad --secret-value "${v}". Use key=value.`);
}

function isSecretValue(v: string): boolean {
  const i = v.indexOf("=");
  return i > 0 && v.slice(0, i).trim().length > 0;
}

When it happens

Trigger: Passing `--secret-value =secretvalue` (empty key) or `--secret-value " =value"` (whitespace-only key). A `--secret-value KEY=` (empty value) does NOT trigger this error — it is accepted.

Common situations: Typing the flag without the key, copy-paste from a secrets file that left the key side blank, or templating that produced an empty key.

Related errors

• Invalid --name-override "${raw}". Use slug=name.
• Invalid JSON: ${err instanceof Error ? err.message : String(
• Company ID is required.
• Catalog team reference is required.
• Approval request failed.

AI-assisted analysis of paperclipai/paperclip@67001ec6eb (2026-08-12). Data as JSON: /api/errors/d884346cb20434a2. Report an issue: GitHub.