windmill-labs/windmill · info

Config contains sensitive fields (license_key, jwt_secret).

Error message

Config contains sensitive fields (license_key, jwt_secret). They are masked by default.

What it means

`wmill instance get-config` masks the sensitive instance config fields `license_key` and `jwt_secret` by default. In an interactive TTY (and not writing to a file) it warns that masking is active and offers `--show-secrets` or an inline Y/N confirm to reveal them.

Source

Thrown at cli/src/commands/instance/instance.ts:676

  if (opts.instance) {
    return opts.instance;
  }
  try {
    return await readTextFile(await getActiveInstanceFilePath());
  } catch {
    return undefined;
  }
}

async function getConfig(opts: InstanceSyncOptions & { outputFile?: string; showSecrets?: boolean }) {
  await pickInstance(opts, false);
  const config = await wmill.getInstanceConfig() as any;

  // In interactive mode, mask secrets by default and prompt
  const hasSecrets = config?.global_settings?.license_key || config?.global_settings?.jwt_secret;
  let showSecrets = opts.showSecrets ?? false;
  if (!showSecrets && hasSecrets && process.stdout.isTTY && !opts.outputFile) {
    log.warn("Config contains sensitive fields (license_key, jwt_secret). They are masked by default.");
    log.warn("Use --show-secrets to include them, or press Y to show them now.");
    showSecrets = await Confirm.prompt({ message: "Show secrets?", default: false });
  } else if (!process.stdout.isTTY || opts.outputFile) {
    // Non-interactive or writing to file: always include secrets
    showSecrets = true;
  }

  if (!showSecrets && config?.global_settings) {
    if (config.global_settings.license_key) config.global_settings.license_key = "***";
    if (config.global_settings.jwt_secret) config.global_settings.jwt_secret = "***";
  }

  const yaml = yamlStringify(config as Record<string, unknown>);
  if (opts.outputFile) {
    await writeFile(opts.outputFile, yaml, "utf-8");
    log.info(colors.green(`Instance config written to ${opts.outputFile}`));
  } else {
    console.log(yaml);

View on GitHub (pinned to e474e8803c)

Solutions

1. Pass `--show-secrets` when you intentionally need the raw values.
2. Answer Y at the 'Show secrets?' prompt for a one-off reveal.
3. Redirect output to a file (`--output-file`) if you need the full config; note non-TTY/file mode always includes secrets, so handle the file securely.

Example fix

// before: secrets masked in output
wmill instance get-config
// after
wmill instance get-config --show-secrets

// check whether the config will contain secrets before printing it
const cfg = await wmill.getInstanceConfig() as any;
const hasSecrets = Boolean(cfg?.global_settings?.license_key || cfg?.global_settings?.jwt_secret);
if (hasSecrets && process.stdout.isTTY) {
  console.log('secrets present — pass --show-secrets if you need raw values');
}

function hasSecrets(cfg: unknown): boolean {
  const g = (cfg as any)?.global_settings;
  return typeof g?.license_key === 'string' && g.license_key.length > 0 ||
         typeof g?.jwt_secret === 'string' && g.jwt_secret.length > 0;
}

try {
  const cfg = await wmill.getInstanceConfig();
} catch (e: any) {
  if (/mask|show-secrets/i.test(e.message ?? '')) {
    // rerun with --show-secrets or capture to a secured file
  }
  throw e;
}

When it happens

Trigger: Running `wmill instance get-config` on an instance whose `global_settings.license_key` or `jwt_secret` is set, in an interactive terminal, without `--show-secrets` and without `--output-file`.

Common situations: Inspecting instance settings during debugging; documenting instance config; running the command in a terminal and wondering why secrets appear as masked.

Related errors

• Use --show-secrets to include them, or press Y to show them
• Skipping ${relPath}: a local secrets file is not part of the
• No encryption key found, skipping encryption. Recommend sett
• bundle produced no javascript:\n${buildOutput}
• App ${appPath} not found

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/526f20297918835c. Report an issue: GitHub.