# Configure secrets without the command line interface

**URL:** <https://community.seqera.io/t/configure-secrets-without-the-command-line-interface/2228>\
**Category:** Ask for help\
**Created:** [June 25, 2025, 9:01pm UTC](https://community.seqera.io/t/configure-secrets-without-the-command-line-interface/2228 "2025-06-25T21:01:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nrminor](https://dub1.discourse-cdn.com/flex013/user_avatar/community.seqera.io/nrminor/32/296_2.png) [@nrminor](https://community.seqera.io/u/nrminor)\
**Post date:** [June 25, 2025, 9:01pm UTC](https://community.seqera.io/t/configure-secrets-without-the-command-line-interface/2228/1 "2025-06-25T21:01:19Z")

</div>

Hi all,

I’ve only just discovered the Nextflow secrets feature and wondered if there was some way I could set secrets without using the command line. For example, if I had a dotfile somewhere in my home directory, could I use groovy to set secrets based on the contents of that file?

Thanks!  
–Nick

---

<div class="post-metadata">

**Author:** ![mribeirodantas](https://dub1.discourse-cdn.com/flex013/user_avatar/community.seqera.io/mribeirodantas/32/235_2.png) [@mribeirodantas](https://community.seqera.io/u/mribeirodantas)\
**Post date:** [June 26, 2025, 2:34pm UTC](https://community.seqera.io/t/configure-secrets-without-the-command-line-interface/2228/2 "2025-06-26T14:34:15Z")

</div>

Hi @nrminor,

The goal of Nextflow Secrets is precisely not having the secret exposed as raw text in your environment, so you need the CLI to set it. You can always have a bash script setting the secrets and running it prior to Nextflow (either manually, or using [beforeScript](https://nextflow.io/docs/latest/reference/process.html#beforescript)), but ideally you should use the CLI.

---

<div class="post-metadata">

**Author:** ![Adam\_Talbot](https://dub1.discourse-cdn.com/flex013/user_avatar/community.seqera.io/adam_talbot/32/62_2.png) [@Adam\_Talbot](https://community.seqera.io/u/Adam_Talbot)\
**Post date:** [June 26, 2025, 4:05pm UTC](https://community.seqera.io/t/configure-secrets-without-the-command-line-interface/2228/3 "2025-06-26T16:05:15Z")

</div>

A community member made nf-dotenv for loading variables from an environment file: [GitHub - fulcrumgenomics/nf-dotenv: Automatically source dotenv files into your Nextflow scope](https://github.com/fulcrumgenomics/nf-dotenv)

---

<div class="post-metadata">

**Author:** ![nrminor](https://dub1.discourse-cdn.com/flex013/user_avatar/community.seqera.io/nrminor/32/296_2.png) [@nrminor](https://community.seqera.io/u/nrminor)\
**Post date:** [June 26, 2025, 8:20pm UTC](https://community.seqera.io/t/configure-secrets-without-the-command-line-interface/2228/4 "2025-06-26T20:20:07Z")

</div>

Thanks @Adam_Talbot - that’s exactly what I was looking for. And understood @mribeirodantas, although I’m under the additional constraint that I’m trying to keep secrets out of both a shared shell history and the environment.

To make matters worse, the pipeline I wanted this for will be running in a shell script in an HTCondor job, such that every time the job runs, it would need to set secrets with the CLI. Only being able to set secrets in the command line encourages putting secrets in the condor script in this case, which I’d like to avoid. Instead, I’d prefer to just pull from a global dotfile that’s not checked into a VCS, and it looks like the plug-in will make that possible.