windmill-labs/windmill · info

Use --show-secrets to include them, or press Y to show them

Error message

Use --show-secrets to include them, or press Y to show them now.

What it means

Second half of the masking notice in `wmill instance get-config`: it tells the user the two ways to unmask — the `--show-secrets` flag or pressing Y at the confirmation prompt. It is only printed when secrets exist, stdout is a TTY, and no output file is set.

Source

Thrown at cli/src/commands/instance/instance.ts:677

    return opts.instance;
  }
  try {
    return await readTextFile(await getActiveInstanceFilePath());
  } catch {
    return undefined;
  }
}

async function getConfig(opts: InstanceSyncOptions & { outputFile?: string; showSecrets?: boolean }) {
  await pickInstance(opts, false);
  const config = await wmill.getInstanceConfig() as any;

  // In interactive mode, mask secrets by default and prompt
  const hasSecrets = config?.global_settings?.license_key || config?.global_settings?.jwt_secret;
  let showSecrets = opts.showSecrets ?? false;
  if (!showSecrets && hasSecrets && process.stdout.isTTY && !opts.outputFile) {
    log.warn("Config contains sensitive fields (license_key, jwt_secret). They are masked by default.");
    log.warn("Use --show-secrets to include them, or press Y to show them now.");
    showSecrets = await Confirm.prompt({ message: "Show secrets?", default: false });
  } else if (!process.stdout.isTTY || opts.outputFile) {
    // Non-interactive or writing to file: always include secrets
    showSecrets = true;
  }

  if (!showSecrets && config?.global_settings) {
    if (config.global_settings.license_key) config.global_settings.license_key = "***";
    if (config.global_settings.jwt_secret) config.global_settings.jwt_secret = "***";
  }

  const yaml = yamlStringify(config as Record<string, unknown>);
  if (opts.outputFile) {
    await writeFile(opts.outputFile, yaml, "utf-8");
    log.info(colors.green(`Instance config written to ${opts.outputFile}`));
  } else {
    console.log(yaml);
  }

View on GitHub (pinned to e474e8803c)

Solutions

1. Rerun with `--show-secrets` to include the fields without prompting.
2. Press Y at the 'Show secrets?' confirm for this invocation only.
3. Use `--output-file` to write the unmasked config to a file (kept secure).

Example fix

// before
wmill instance get-config
// after
wmill instance get-config --show-secrets

// same pre-check as the masking notice
const cfg = await wmill.getInstanceConfig() as any;
if (cfg?.global_settings?.license_key || cfg?.global_settings?.jwt_secret) {
  console.log('run with --show-secrets to see raw values');
}

function needsShowSecrets(opts: { showSecrets?: boolean; outputFile?: string }): boolean {
  return !opts.showSecrets && !opts.outputFile;
}

null

When it happens

Trigger: Same conditions as the masking warning: `wmill instance get-config` with license_key/jwt_secret present, interactive TTY, no `--show-secrets`, no `--outputFile`.

Common situations: Users who missed the flag in `--help`; scripts that wrap interactive sessions and only capture the first warning line.

Related errors

• Config contains sensitive fields (license_key, jwt_secret).
• Skipping ${relPath}: a local secrets file is not part of the
• No encryption key found, skipping encryption. Recommend sett
• bundle produced no javascript:\n${buildOutput}
• App ${appPath} not found

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/2a5c4b7aec17bbd0. Report an issue: GitHub.