> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xloud.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Key Manager CLI Reference

> Complete openstack secret CLI commands for managing secrets, containers, certificates, and ACLs in Xloud Key Manager.

## Overview

The `openstack secret` command group manages secrets, containers, and access control policies in the Xloud Key Manager service.

<Note>
  **Prerequisites**

  * CLI installed and authenticated — see [CLI Setup](/cli-setup)
  * Python barbicanclient installed: `pip install python-barbicanclient`
</Note>

***

## Secrets

<CodeGroup>
  ```bash title="List secrets" theme={null}
  openstack secret list
  ```

  ```bash title="Store a passphrase" theme={null}
  openstack secret store \
    --name db-password \
    --secret-type passphrase \
    --payload "my-secure-password"
  ```

  ```bash title="Store a symmetric key" theme={null}
  openstack secret order create \
    --name aes-key \
    --algorithm aes \
    --bit-length 256 \
    --mode cbc \
    key
  ```

  ```bash title="Store from file" theme={null}
  openstack secret store \
    --name tls-cert \
    --secret-type certificate \
    --file /path/to/cert.pem \
    --payload-content-type "application/octet-stream"
  ```

  ```bash title="Show secret metadata" theme={null}
  openstack secret get <secret-href>
  ```

  ```bash title="Retrieve secret payload" theme={null}
  openstack secret get --payload <secret-href>
  ```

  ```bash title="Delete secret" theme={null}
  openstack secret delete <secret-href>
  ```
</CodeGroup>

***

## Containers

<CodeGroup>
  ```bash title="List containers" theme={null}
  openstack secret container list
  ```

  ```bash title="Create certificate container" theme={null}
  openstack secret container create \
    --name my-tls \
    --type certificate \
    --secret "certificate=<cert-href>" \
    --secret "private_key=<key-href>"
  ```

  ```bash title="Show container" theme={null}
  openstack secret container get <container-href>
  ```

  ```bash title="Delete container" theme={null}
  openstack secret container delete <container-href>
  ```
</CodeGroup>

***

## Orders (Key Generation)

<CodeGroup>
  ```bash title="List orders" theme={null}
  openstack secret order list
  ```

  ```bash title="Generate AES key" theme={null}
  openstack secret order create \
    --name my-key \
    --algorithm aes \
    --bit-length 256 \
    key
  ```

  ```bash title="Show order" theme={null}
  openstack secret order get <order-href>
  ```

  ```bash title="Delete order" theme={null}
  openstack secret order delete <order-href>
  ```
</CodeGroup>

***

## ACLs

<CodeGroup>
  ```bash title="Show ACL for secret" theme={null}
  openstack acl get <secret-href>
  ```

  ```bash title="Grant read access to a user" theme={null}
  openstack acl submit \
    --user <user-id> \
    --operation-type read \
    <secret-href>
  ```

  ```bash title="Delete ACL" theme={null}
  openstack acl delete <secret-href>
  ```
</CodeGroup>

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Store Secrets Guide" href="/services/key-manager/store-secrets" color="#197560">
    Guide to storing and retrieving secrets securely
  </Card>

  <Card title="Certificates Guide" href="/services/key-manager/certificates" color="#197560">
    Manage TLS certificates and certificate orders
  </Card>
</CardGroup>