@indigoai-us/hq-cli 5.77.11 → 5.77.12

package/src/commands/api-keys.ts

@@ -1,8 +1,14 @@
 import { Command } from "commander";
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { assertCognitoOnlyCommand } from "../utils/resolve-vault-credential.js";
 import { getCompanyUid, vaultApiFetch } from "./secrets.js";
 
+async function requireCognitoForApiKeys(label: string): Promise<string> {
+  assertCognitoOnlyCommand(label);
+  return ensureCognitoToken();
+}
+
 type ApiKeyPermission = "read" | "write" | "admin";
 
 interface ApiKeyMetadata {
@@ -12,6 +18,10 @@ interface ApiKeyMetadata {
   scope: {
     allowedPrefixes: string[];
     permission: ApiKeyPermission;
+    deploy?: {
+      apps: string[];
+      capabilities: string[];
+    };
   };
   status: string;
   createdAt: string;
@@ -42,6 +52,7 @@ interface ApiKeysGroupOptions {
 interface CreateApiKeyOptions {
   name: string;
   scope: string[];
+  deployApp: string[];
   permission: string;
   expires?: string;
 }
@@ -58,6 +69,13 @@ function formatPrefixes(prefixes: string[]): string {
   return prefixes.length > 0 ? prefixes.join(", ") : "-";
 }
 
+function formatDeployApps(
+  deploy?: { apps: string[]; capabilities: string[] },
+): string {
+  if (!deploy?.apps?.length) return "-";
+  return deploy.apps.join(", ");
+}
+
 function parsePermission(value: string): ApiKeyPermission {
   if (value === "read" || value === "write" || value === "admin") {
     return value;
@@ -107,6 +125,7 @@ function renderApiKeysTable(apiKeys: ApiKeyMetadata[]): void {
     name: apiKey.name,
     permission: apiKey.scope.permission,
     prefixes: formatPrefixes(apiKey.scope.allowedPrefixes),
+    deployApps: formatDeployApps(apiKey.scope.deploy),
     status: apiKey.status,
     lastUsedAt: formatMaybe(apiKey.lastUsedAt),
     expiresAt: formatMaybe(apiKey.expiresAt),
@@ -119,6 +138,7 @@ function renderApiKeysTable(apiKeys: ApiKeyMetadata[]): void {
     ...rows.map((row) => row.permission.length),
   );
   const prefixesWidth = Math.max(8, ...rows.map((row) => row.prefixes.length));
+  const deployWidth = Math.max(6, ...rows.map((row) => row.deployApps.length));
   const statusWidth = Math.max(6, ...rows.map((row) => row.status.length));
   const lastUsedWidth = Math.max(
     11,
@@ -134,6 +154,7 @@ function renderApiKeysTable(apiKeys: ApiKeyMetadata[]): void {
     "NAME".padEnd(nameWidth),
     "PERMISSION".padEnd(permissionWidth),
     "PREFIXES".padEnd(prefixesWidth),
+    "DEPLOY".padEnd(deployWidth),
     "STATUS".padEnd(statusWidth),
     "LAST USED".padEnd(lastUsedWidth),
     "EXPIRES".padEnd(expiresWidth),
@@ -147,6 +168,7 @@ function renderApiKeysTable(apiKeys: ApiKeyMetadata[]): void {
         row.name.padEnd(nameWidth),
         row.permission.padEnd(permissionWidth),
         row.prefixes.padEnd(prefixesWidth),
+        row.deployApps.padEnd(deployWidth),
         row.status.padEnd(statusWidth),
         row.lastUsedAt.padEnd(lastUsedWidth),
         row.expiresAt.padEnd(expiresWidth),
@@ -163,32 +185,42 @@ export function registerApiKeysCommand(program: Command): Command {
 
   apiKeys
     .command("create")
-    .description("Create a new API key")
+    .description(
+      "Create a new API key (vault secrets and/or scoped deploy via --deploy-app)",
+    )
     .requiredOption("--name <label>", "Human-readable label for the API key")
     .option(
       "--scope <prefix>",
-      "Allowed prefix (repeatable)",
+      "Allowed secret prefix (repeatable)",
+      collectRepeatedOption,
+      [],
+    )
+    .option(
+      "--deploy-app <id>",
+      "Deploy app id/slug allowed for publish (repeatable)",
       collectRepeatedOption,
       [],
     )
     .option(
       "--permission <level>",
-      "Permission level: read | write | admin",
+      "Secret permission level: read | write | admin (required when --scope is set)",
       "read",
     )
     .option("--expires <ISO8601>", "Optional ISO-8601 expiry timestamp")
     .action(async (opts: CreateApiKeyOptions) => {
       try {
-        if (opts.scope.length === 0) {
+        if (opts.scope.length === 0 && opts.deployApp.length === 0) {
           console.error(
-            chalk.red("Error: at least one --scope <prefix> is required."),
+            chalk.red(
+              "Error: provide at least one --scope <prefix> and/or --deploy-app <id>.",
+            ),
           );
           process.exit(1);
         }
 
         const permission = parsePermission(opts.permission);
         const expiresAt = parseExpires(opts.expires);
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoForApiKeys("api-keys create");
         const companyUid = await getCompanyUid(
           token,
           (apiKeys.opts() as ApiKeysGroupOptions).company,
@@ -201,8 +233,20 @@ export function registerApiKeysCommand(program: Command): Command {
           body: {
             companyUid,
             name: opts.name,
-            allowedPrefixes: opts.scope,
-            permission,
+            ...(opts.scope.length > 0
+              ? { allowedPrefixes: opts.scope, permission }
+              : {}),
+            ...(opts.deployApp.length > 0
+              ? {
+                  deploy: {
+                    apps: opts.deployApp,
+                    capabilities: ["deploy:write"],
+                  },
+                }
+              : {}),
+            ...(opts.scope.length === 0 && opts.deployApp.length > 0
+              ? { permission }
+              : {}),
             ...(expiresAt ? { expiresAt } : {}),
           },
         });
@@ -225,10 +269,42 @@ export function registerApiKeysCommand(program: Command): Command {
         console.log(
           `  Prefixes: ${formatPrefixes(data.apiKey.scope.allowedPrefixes)}`,
         );
+        console.log(
+          `  Deploy apps: ${formatDeployApps(data.apiKey.scope.deploy)}`,
+        );
         console.log(`  Status: ${data.apiKey.status}`);
         console.log(`  Created: ${data.apiKey.createdAt}`);
         console.log(`  Last used: ${formatMaybe(data.apiKey.lastUsedAt)}`);
         console.log(`  Expires: ${formatMaybe(data.apiKey.expiresAt)}`);
+        console.log("");
+        console.log(chalk.bold("Usage"));
+        console.log(
+          "  This key acts as you (Cognito identity), limited to the scopes above.",
+        );
+        console.log("  Export it for automation (never falls back to a session):");
+        console.log(`\n  export HQ_API_KEY='${data.key.value}'\n`);
+        console.log("  Vault secrets:");
+        console.log("    hq secrets get <NAME> --reveal");
+        console.log("    hq secrets exec --only <NAME> -- <command>");
+        console.log(
+          "    Or HTTP: POST /v1/keys/secrets/fetch with Authorization: Bearer <key>",
+        );
+        if (data.apiKey.scope.deploy?.apps?.length) {
+          console.log("  Deploy (scoped apps only):");
+          console.log(
+            "    Authorization: Bearer <key> against the hq-deploy API",
+          );
+          console.log(
+            chalk.dim(
+              "    Cannot change access-mode, password, or mint hqd_ keys.",
+            ),
+          );
+        }
+        console.log(
+          chalk.dim(
+            "  Unsupported under HQ_API_KEY: secrets list/set/share/acl (use a Cognito session).",
+          ),
+        );
       } catch (err) {
         console.error(
           chalk.red("Error:"),
@@ -243,7 +319,7 @@ export function registerApiKeysCommand(program: Command): Command {
     .description("List API keys for a company")
     .action(async () => {
       try {
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoForApiKeys("api-keys list");
         const companyUid = await getCompanyUid(
           token,
           (apiKeys.opts() as ApiKeysGroupOptions).company,
@@ -280,7 +356,7 @@ export function registerApiKeysCommand(program: Command): Command {
     .description("Revoke an API key")
     .action(async (keyId: string) => {
       try {
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoForApiKeys("api-keys revoke");
         const res = await vaultApiFetch({
           token,
           path: `/v1/api-keys/${encodeURIComponent(keyId)}/revoke`,

package/src/commands/secrets.test.ts

@@ -1902,3 +1902,136 @@ describe("secrets reveal and policy controls", () => {
     );
   });
 });
+
+describe("HQ_API_KEY consume path", () => {
+  let exitSpy: MockInstance<typeof process.exit>;
+
+  beforeEach(() => {
+    exitSpy = vi
+      .spyOn(process, "exit")
+      .mockImplementation(((code?: number) => {
+        throw new Error(`__EXIT__:${code ?? 0}`);
+      }) as never);
+  });
+
+  afterEach(() => {
+    delete process.env.HQ_API_KEY;
+  });
+
+  it("rejects secrets list when HQ_API_KEY is set (no Cognito fallback)", async () => {
+    process.env.HQ_API_KEY = "hqk_probe";
+    const program = buildProgram();
+    await expect(
+      program.parseAsync(["node", "hq", "secrets", "list"]),
+    ).rejects.toThrow(/__EXIT__:1/);
+    expect(ensureCognitoToken).not.toHaveBeenCalled();
+    expect(vaultApiFetch).not.toHaveBeenCalled();
+    const errText = errSpy.mock.calls
+      .map((call) => call.map(String).join(" "))
+      .join("\n");
+    expect(errText).toMatch(/not supported for API keys/);
+  });
+
+  it("rejects invalid HQ_API_KEY prefix without Cognito fallback", async () => {
+    process.env.HQ_API_KEY = "hqd_not_a_vault_key";
+    const program = buildProgram();
+    await expect(
+      program.parseAsync(["node", "hq", "secrets", "get", "FOO"]),
+    ).rejects.toThrow(/__EXIT__:1/);
+    expect(ensureCognitoToken).not.toHaveBeenCalled();
+    const errText = errSpy.mock.calls
+      .map((call) => call.map(String).join(" "))
+      .join("\n");
+    expect(errText).toMatch(/must start with 'hqk_'/);
+  });
+
+  it("gets a secret via /v1/keys/secrets/fetch when HQ_API_KEY is set", async () => {
+    process.env.HQ_API_KEY = "hqk_valid_key";
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        secret: {
+          name: "FOO",
+          value: "secret-value",
+          version: 1,
+          tier: "standard",
+        },
+      }),
+    );
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "get",
+      "FOO",
+      "--reveal",
+    ]);
+
+    expect(ensureCognitoToken).not.toHaveBeenCalled();
+    expect(vaultApiFetch).toHaveBeenCalledWith(
+      expect.objectContaining({
+        token: "hqk_valid_key",
+        path: "/v1/keys/secrets/fetch",
+        method: "POST",
+        body: { name: "FOO" },
+      }),
+    );
+    const printed = logSpy.mock.calls
+      .map((call) => call.map(String).join(" "))
+      .join("\n");
+    expect(printed).toContain("FOO");
+    expect(printed).toContain("secret-value");
+    expect(exitSpy).not.toHaveBeenCalled();
+  });
+
+  it("fails --reveal when API-key fetch omits secret.value", async () => {
+    process.env.HQ_API_KEY = "hqk_valid_key";
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        secret: {
+          name: "FOO",
+          version: 1,
+          tier: "standard",
+        },
+      }),
+    );
+
+    const program = buildProgram();
+    await expect(
+      program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "get",
+        "FOO",
+        "--reveal",
+      ]),
+    ).rejects.toThrow(/__EXIT__:1/);
+    const errText = errSpy.mock.calls
+      .map((call) => call.map(String).join(" "))
+      .join("\n");
+    expect(errText).toMatch(/omitted secret\.value/);
+    const printed = logSpy.mock.calls
+      .map((call) => call.map(String).join(" "))
+      .join("\n");
+    expect(printed).not.toContain("[REDACTED]");
+  });
+
+  it("loadRevealedSecrets uses fetch endpoint for hqk_ tokens", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        secret: { name: "A", value: "va" },
+      }),
+    );
+    const out = await loadRevealedSecrets("hqk_tok", "cmp_x", ["A"]);
+    expect(out.get("A")).toBe("va");
+    expect(vaultApiFetch).toHaveBeenCalledWith(
+      expect.objectContaining({
+        path: "/v1/keys/secrets/fetch",
+        method: "POST",
+        body: { name: "A" },
+      }),
+    );
+  });
+});

package/src/commands/secrets.ts

@@ -23,6 +23,11 @@ import {
   getCompanyUid,
   getEntityUid,
 } from "../utils/vault-api.js";
+import {
+  HQ_API_KEY_PREFIX,
+  assertCognitoOnlyCommand,
+  resolveVaultCredential,
+} from "../utils/resolve-vault-credential.js";
 import {
   SandboxRunnerClient,
   type SandboxRunnerJob,
@@ -30,6 +35,14 @@ import {
 export type { VaultApiOptions } from "../utils/vault-api.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
 
+/** Cognito session for secrets commands that do not support HQ_API_KEY. */
+async function requireCognitoTokenForSecrets(
+  commandLabel: string,
+): Promise<string> {
+  assertCognitoOnlyCommand(commandLabel);
+  return ensureCognitoToken();
+}
+
 interface SecretsScopeOpts {
   company?: string;
   personal?: boolean;
@@ -654,12 +667,76 @@ function renderPolicyScripts(scripts: SecretPolicyScript[]): void {
 // Requests are chunked at MAX_BATCH_NAMES and throw on the FIRST unresolved key
 // with the same `Failed to fetch secret '<k>': <reason>` shape the per-key GET
 // path used — never swallows a failure.
+async function loadRevealedSecretsViaApiKey(
+  token: string,
+  keys: string[],
+): Promise<Map<string, string>> {
+  const resolved = new Map<string, string>();
+  const requested = [...new Set(keys)];
+  const cacheScope = "__api_key__";
+
+  for (const name of requested) {
+    const res = await vaultApiFetch({
+      token,
+      path: "/v1/keys/secrets/fetch",
+      method: "POST",
+      body: { name },
+      signal: AbortSignal.timeout(SECRET_LOAD_TIMEOUT_MS),
+    });
+    const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
+
+    if (!res.ok) {
+      if (res.status === 404) {
+        throw new Error(`Failed to fetch secret '${name}': Secret not found`);
+      }
+      if (res.status === 403) {
+        const message =
+          typeof body.error === "string"
+            ? body.error
+            : typeof body.message === "string"
+              ? body.message
+              : "No read permission";
+        if (body.highSecurity === true) {
+          throw new Error(highSecuritySandboxOnlyMessage(name));
+        }
+        throw new Error(`Failed to fetch secret '${name}': ${message}`);
+      }
+      if (res.status === 401) {
+        throw new Error(
+          `Failed to fetch secret '${name}': Invalid or missing API key`,
+        );
+      }
+      throw new Error(
+        `Failed to fetch secret '${name}': ${extractApiMessage(body, res.statusText)}`,
+      );
+    }
+
+    const secret =
+      typeof body.secret === "object" && body.secret !== null
+        ? (body.secret as { value?: unknown; name?: unknown })
+        : null;
+    if (typeof secret?.value !== "string") {
+      throw new Error(
+        `Failed to fetch secret '${name}': malformed fetch response`,
+      );
+    }
+    removeCacheEntry(cacheScope, name);
+    resolved.set(name, secret.value);
+  }
+
+  return resolved;
+}
+
 export async function loadRevealedSecrets(
   token: string,
   companyUid: string,
   keys: string[],
   usage?: SecretUsage,
 ): Promise<Map<string, string>> {
+  if (token.startsWith(HQ_API_KEY_PREFIX)) {
+    return loadRevealedSecretsViaApiKey(token, keys);
+  }
+
   const resolved = new Map<string, string>();
   const requested = [...new Set(keys)];
   try {
@@ -918,7 +995,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets set");
         const scope = scopeOpts(secrets.opts());
         const companyUid = await getEntityUid(token, scope);
         const scopeLabel = describeSecretsScope({
@@ -975,7 +1052,69 @@ export function registerSecretsCommand(program: Command): void {
     .option("--reveal", "Include the decrypted secret value")
     .action(async (name: string, opts: { reveal?: boolean }) => {
       try {
-        const token = await ensureCognitoToken();
+        const cred = await resolveVaultCredential();
+
+        if (cred.kind === "api-key") {
+          const res = await vaultApiFetch({
+            token: cred.token,
+            path: "/v1/keys/secrets/fetch",
+            method: "POST",
+            body: { name },
+          });
+          const body = (await res.json().catch(() => ({}))) as Record<
+            string,
+            unknown
+          >;
+          if (!res.ok) {
+            if (res.status === 403 && body.highSecurity === true) {
+              console.error(chalk.red(highSecuritySandboxOnlyMessage(name)));
+              process.exit(1);
+            }
+            console.error(
+              chalk.red(
+                `Failed to get secret: ${extractApiMessage(body, res.statusText)}`,
+              ),
+            );
+            process.exit(1);
+          }
+          const secret =
+            typeof body.secret === "object" && body.secret !== null
+              ? (body.secret as SecretGetResponse["secret"] & {
+                  value?: string;
+                })
+              : null;
+          if (!secret || typeof secret.name !== "string") {
+            console.error(chalk.red("Failed to get secret: malformed response"));
+            process.exit(1);
+          }
+          console.log(chalk.bold(`Secret: ${secret.name}`));
+          if (secret.lastModifiedDate) {
+            console.log(`  Last Modified: ${secret.lastModifiedDate}`);
+          }
+          if (secret.version != null) {
+            console.log(`  Version:       ${secret.version}`);
+          }
+          console.log(`  Tier:          ${normalizeSecretTier(secret.tier)}`);
+          console.log(
+            `  Script Lock:   ${normalizeScriptLockMode(secret.scriptLock?.mode)}`,
+          );
+          if (opts.reveal) {
+            if (typeof secret.value !== "string") {
+              console.error(
+                chalk.red(
+                  "Failed to get secret: reveal requested but response omitted secret.value",
+                ),
+              );
+              process.exit(1);
+            }
+            console.log(`  Value:         ${secret.value}`);
+          } else {
+            console.log(`  Value:         ${chalk.dim("[REDACTED]")}`);
+          }
+          return;
+        }
+
+        const token = cred.token;
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1061,7 +1200,7 @@ export function registerSecretsCommand(program: Command): void {
     .option("--quiet", "Suppress the present/absent line (use the exit code only)")
     .action(async (name: string, opts: { quiet?: boolean }) => {
       try {
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets exists");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1124,7 +1263,7 @@ export function registerSecretsCommand(program: Command): void {
           normalizedPrefix = normalized;
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets list");
         const scope = scopeOpts(secrets.opts());
         const companyUid = await getEntityUid(token, scope);
         const scopeLabel = describeSecretsScope({
@@ -1226,7 +1365,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1309,7 +1448,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1392,7 +1531,7 @@ export function registerSecretsCommand(program: Command): void {
           opts.id,
           opts.attestation,
         );
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1442,7 +1581,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1485,7 +1624,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1546,7 +1685,7 @@ export function registerSecretsCommand(program: Command): void {
           }
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1606,7 +1745,7 @@ export function registerSecretsCommand(program: Command): void {
         }
 
         const keys = parseSecretNameList(opts.only);
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const scope = scopeOpts(mergeScopeOpts(secrets.opts(), opts));
         const companyUid = await getEntityUid(token, scope);
         const client = new SandboxRunnerClient();
@@ -1673,17 +1812,19 @@ export function registerSecretsCommand(program: Command): void {
 
         const keys = parseSecretNameList(_opts.only);
 
-        const token = await ensureCognitoToken();
-        const companyUid = await getEntityUid(
-          token,
-          scopeOpts(secrets.opts()),
-        );
+        const cred = await resolveVaultCredential();
+        const companyUid =
+          cred.kind === "api-key"
+            ? "__api_key__"
+            : await getEntityUid(cred.token, scopeOpts(secrets.opts()));
 
         const revealed = await loadRevealedSecrets(
-          token,
+          cred.token,
           companyUid,
           keys,
-          await buildSecretUsage("exec", _opts.script, _opts.scriptId),
+          cred.kind === "cognito"
+            ? await buildSecretUsage("exec", _opts.script, _opts.scriptId)
+            : undefined,
         );
 
         const secretEnv: Record<string, string> = {};
@@ -1744,17 +1885,19 @@ export function registerSecretsCommand(program: Command): void {
 
         const keys = parseSecretNameList(opts.only);
 
-        const token = await ensureCognitoToken();
-        const companyUid = await getEntityUid(
-          token,
-          scopeOpts(secrets.opts()),
-        );
+        const cred = await resolveVaultCredential();
+        const companyUid =
+          cred.kind === "api-key"
+            ? "__api_key__"
+            : await getEntityUid(cred.token, scopeOpts(secrets.opts()));
 
         const revealed = await loadRevealedSecrets(
-          token,
+          cred.token,
           companyUid,
           keys,
-          await buildSecretUsage("env", opts.script, opts.scriptId),
+          cred.kind === "cognito"
+            ? await buildSecretUsage("env", opts.script, opts.scriptId)
+            : undefined,
         );
 
         for (const key of keys) {
@@ -1799,7 +1942,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1865,7 +2008,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1929,7 +2072,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1985,7 +2128,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),