### Setup Doppler Project and Config

Source: https://docs.doppler.com/docs/bitbucket-pipelines-doppler-cli

Run `doppler setup` to select the project and config for importing Bitbucket repository variables.

```shell
doppler setup # Select the project and config for importing to
```

--------------------------------

### Install Doppler CLI in Ubuntu Build Image

Source: https://docs.doppler.com/docs/bitbucket-pipelines-doppler-cli

Embed the Doppler CLI in your build image for optimized builds. This example shows installation for Ubuntu.

```yaml
image: ubuntu
pipelines:
  default:
    - step:
        script:
          - apt-get update && apt-get install gnupg wget -y
          - wget -t 3 -qO- https://cli.doppler.com/install.sh | sh
          - doppler run -- ./bin/build.sh # Build script or command
```

--------------------------------

### Install Doppler CLI in Alpine Build Image

Source: https://docs.doppler.com/docs/bitbucket-pipelines-doppler-cli

Embed the Doppler CLI in your build image for optimized builds. This example shows installation for Alpine.

```yaml
image: alpine
pipelines:
  default:
    - step:
        script:          
          - apk add wget gnupg
          - wget -t 3 -qO- https://cli.doppler.com/install.sh | sh
          - doppler run -- ./bin/build.sh # Build script or command
```

--------------------------------

### Install Doppler CLI in BuddyCI

Source: https://docs.doppler.com/docs/buddyci

Add these commands to the 'Customize Environment' section of your BuddyCI pipeline to install the Doppler CLI. This ensures the CLI is available in your Docker image for subsequent commands.

```bash
apt-get update && apt-get install -y doppler

```

--------------------------------

### Install Doppler CLI in Azure DevOps Pipeline

Source: https://docs.doppler.com/docs/azure-devops-pipelines

Installs the Doppler CLI using a shell script. Ensure the script is downloaded securely and retries are configured.

```yaml
trigger:
  - main

pool:
  vmImage: ubuntu-latest

steps:
  - script: |
      (curl -Ls --tlsv1.2 --proto "=https" --retry 3 https://cli.doppler.com/install.sh || wget -t 3 -qO- https://cli.doppler.com/install.sh) | sudo sh
    displayName: Install Doppler CLI
```

--------------------------------

### Create SSH Authorized Keys File

Source: https://docs.doppler.com/docs/accessing-secrets

Generate an `authorized_keys` file for SSH using secrets prefixed with `SSH_PUB_KEY_`. This example demonstrates combining `grep` and `cut` for specific formatting.

```shell
# If secrets in Doppler were
# SSH_PUB_KEY_SERVER_A="ssh-ed25519 AAA..."
# SSH_PUB_KEY_SERVER_B="ssh-ed25519 BBB..."

doppler secrets download --no-file --format env-no-quotes | grep ^SSH_PUB_KEY_ | cut -d"=" -f2 > authorized_keys && chmod 600 authorized_keys
```

--------------------------------

### Run Process with Injected Secrets

Source: https://docs.doppler.com/docs/aws-ec2-oidc

Inject secrets into a process using 'doppler run'. This is useful for starting applications with environment variables pre-loaded.

```bash
doppler run --project my-app --config production -- ./start-server.sh
```

--------------------------------

### AWS Lambda Environment Variables Output

Source: https://docs.doppler.com/docs/aws-lambda

This is an example of the JSON output from the AWS CLI, showing the secrets successfully synced as environment variables.

```json
"Environment": {
    "Variables": {
        "API_KEY": "6387dc57-25c9-48d4-8969-bc5ba7dc72a2",
        "DOPPLER_CONFIG": "prd",
        "DB_URL": "postgres.123456789012.us-west-2.rds.amazonaws.com",
        "DOPPLER_ENVIRONMENT": "prd",
        "DOPPLER_PROJECT": "lambda"
    }
}
"
```

--------------------------------

### Use Dynamic Secrets with AWS CLI

Source: https://docs.doppler.com/docs/aws-iam

Example demonstrating how to use a dynamic secret lease with the AWS CLI to describe EC2 instances. Ensure you replace `AWS_USER` with your dynamic secret's name.

```shell
doppler run -- zsh
AWS_ACCESS_KEY_ID=$AWS_USER_ACCESS_KEY_ID \
        AWS_SECRET_ACCESS_KEY=$AWS_USER_SECRET_ACCESS_KEY \
        aws ec2 describe-instances \
        --output table \
        --region us-east-1 \
        --filters --query "Reservations[].Instances[].InstanceId"
-------------------------
|   DescribeInstances   |
+-----------------------+
|  i-0ca2eac84e626db17  |
+-----------------------+

```

--------------------------------

### Target Personal Config in doppler.yaml

Source: https://docs.doppler.com/docs/branch-configs

Configure your application to target the `dev_personal` branch config for local development. This ensures that setup scripts only affect the individual Doppler user's personal config.

```yaml
setup:
  - project: example
    config: dev_personal
```

--------------------------------

### Get Secrets in Plain Text or JSON Format

Source: https://docs.doppler.com/docs/accessing-secrets

Retrieve secrets for a specific Doppler project and configuration. Use `--plain` for plain text output or `--json` for JSON output.

```shell
doppler secrets get DOPPLER_PROJECT DOPPLER_CONFIG --plain
```

```shell
doppler secrets get DOPPLER_PROJECT DOPPLER_CONFIG --json
```

--------------------------------

### Sync Secrets to AWS Lambda Environment

Source: https://docs.doppler.com/docs/aws-lambda

Use this command to download all secrets in JSON format and update the AWS Lambda function's environment variables. Ensure you have jq installed for JSON processing.

```shell
aws lambda update-function-configuration --function-name $FUNCTION_NAME \
    --environment "$(doppler secrets download --no-file | jq '{Variables: .}')"
```

--------------------------------

### Download secrets to files

Source: https://docs.doppler.com/docs/accessing-secrets

Download secrets to specific files using `doppler secrets get --plain > file_path`. This method is useful for supplying secrets like TLS certificates and keys to services.

```shell
doppler secrets get TLS_CERT --plain > /etc/tls/cert.pem
doppler secrets get TLS_KEY --plain > /etc/tls/key.pem
```

--------------------------------

### Get Managing Service Principal Object ID with Azure CLI

Source: https://docs.doppler.com/docs/azure-dynamic-service-principal

Use this command to retrieve the Object ID of the managing Service Principal, which is required when using the 'Application.ReadWrite.OwnedBy' permission.

```bash
az ad sp show --id <managing-sp-client-id> --query id -o tsv

```

--------------------------------

### Get Managing Service Principal Object ID with Azure CLI

Source: https://docs.doppler.com/docs/azure-service-principal

Use this command to retrieve the Object ID of the managing Service Principal, which is required for adding it as an owner to the target application.

```bash
az ad sp show --id <managing-sp-client-id> --query id -o tsv
```

--------------------------------

### Parse JSON Secrets in Java

Source: https://docs.doppler.com/docs/aws-ecs

This Java example uses Jackson databind to parse the DOPPLER_SECRETS environment variable. It includes checks for the variable's existence and handles potential parsing exceptions. Ensure you have the Jackson dependency.

```java
// == Maven Dependency ==
//
// <dependency>
//    <groupId>com.fasterxml.jackson.core</groupId>
//    <artifactId>jackson-databind</artifactId>
//    <version>2.18.3</version> <!-- Use the latest version -->
// </dependency>

import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;

import java.util.Map;

public class DopplerSecretsParser {
    public static void main(String[] args) {
        String dopplerSecrets = System.getenv("DOPPLER_SECRETS");

        if (dopplerSecrets == null || dopplerSecrets.isEmpty()) {
            System.out.println("DOPPLER_SECRETS environment variable isn't set");
            return;
        }

        ObjectMapper objectMapper = new ObjectMapper();
        try {
            JsonNode secretsNode = objectMapper.readTree(dopplerSecrets);

            if (secretsNode.has("API_KEY")) {
                String apiKey = secretsNode.get("API_KEY").asText();
                System.out.println("API_KEY: " + apiKey);
            } else {
                System.out.println("API_KEY not found in secrets");
            }
        } catch (Exception e) {
            System.out.println("Error parsing DOPPLER_SECRETS: " + e.getMessage());
        }
    }
}
```

--------------------------------

### Example JWT Claims Structure

Source: https://docs.doppler.com/docs/aws-ec2-oidc

Reference JWT claims minted by AWS STS. Top-level claims like 'aud', 'sub', and 'iss' are validated directly. AWS-specific metadata is nested within 'https://sts.amazonaws.com/'.

```json
{
  "aud": "doppler",
  "sub": "arn:aws:iam::123456789012:role/ec2-doppler-oidc",
  "iss": "https://96e40952-de33-4e54-a532-d0c9b6136950.tokens.sts.global.api.aws",
  "exp": 1775499921,
  "iat": 1775499621,
  "https://sts.amazonaws.com/": {
    "aws_account": "123456789012",
    "ec2_source_instance_arn": "arn:aws:ec2:us-east-1:123456789012:instance/i-0abc123def456789",
    "source_region": "us-east-1",
    "ec2_instance_source_vpc": "vpc-012d5d9206d99ef27",
    "ec2_instance_source_private_ipv4": "172.31.69.150",
    "org_id": "o-abc123def4"
  }
}
```

--------------------------------

### Upload AWS SSM Parameters to Doppler

Source: https://docs.doppler.com/docs/aws-parameter-store

This script pulls parameters from AWS Systems Manager Parameter Store, converts them to a JSON format expected by Doppler, and uploads them using the Doppler CLI. Ensure you have the AWS CLI, jq, and Doppler CLI installed and configured.

```shell
PROJECT_NAME=your-doppler-project-name
CONFIG_NAME=your-doppler-config-name
AWS_PARAM_STORE_PATH=/some/path
doppler secrets upload -p $PROJECT_NAME -c $CONFIG_NAME <(aws ssm get-parameters-by-path --path $AWS_PARAM_STORE_PATH --with-decryption | jq '.Parameters[] | { (.Name | split("/") | last | ascii_upcase): .Value }' | jq -s add)
```

--------------------------------

### Fetch plain secret value

Source: https://docs.doppler.com/docs/accessing-secrets

Retrieve the plain text value of a single secret using `doppler secrets get --plain`. This is useful for secrets like JSON credentials that need to be written to a file.

```shell
doppler secrets get GCP_SERVICE_ACCOUNT_JSON --plain > gcp_credentials.json
```

--------------------------------

### Override Azure SP Secret TTL via CLI

Source: https://docs.doppler.com/docs/azure-dynamic-service-principal

To set a custom Time-To-Live (TTL) for the leased secret, use the `--dynamic-ttl` flag with the `doppler secrets download` command. This example sets the TTL to 2 hours and extracts the new expiration time.

```shell
doppler secrets download --dynamic-ttl 2h --no-file | jq .AZURE_SP_LEASE_EXPIRATION
"2026-03-10T20:00:00.000Z"

```

--------------------------------

### Import Deployment Variables to Doppler

Source: https://docs.doppler.com/docs/bitbucket-pipelines-doppler-cli

This script imports deployment variables from a specified Bitbucket environment into Doppler. It first sets up the Doppler CLI, constructs the API endpoint using a previously obtained environment UUID, and then uploads the secrets.

```shell
# 1. Select config that deployment variables will be imported to
doppler setup

# 2. Construct the URL to fetch deployment variables using the appropriate `BITBUCKET_ENV_UUID` environment variable, e.g. $PRODUCTION_BITBUCKET_ENV_UUID
DEPLOYMENT_VARIABLES_ENDPOINT="https://api.bitbucket.org/2.0/repositories/$WORKPLACE/$REPO_SLUG/deployments_config/environments/$PRODUCTION_BITBUCKET_ENV_UUID/variables"

# 3. Import variables
doppler secrets upload <(curl -s -u "$WORKPLACE:$APP_PASSWORD" "$DEPLOYMENT_VARIABLES_ENDPOINT" | jq -r '.values | to_entries[] |  "(.value.key)=\"(.value.value)\""')
```

--------------------------------

### Save and Access Fallback File with Passphrase

Source: https://docs.doppler.com/docs/automatic-fallbacks

Demonstrates saving a fallback file during a build process and accessing secrets at runtime using the same passphrase. Storing the passphrase in Doppler and using secret referencing is recommended for synchronization.

```shell
# Save fallback file during build process
doppler run --fallback doppler.encrypted.json --passphrase "$DOPPLER_PASSPHRASE"

# Access secrets at runtime
doppler run --fallback doppler.encrypted.json --passphrase "$DOPPLER_PASSPHRASE" -- printenv
```

--------------------------------

### Fetch Bitbucket Environment UUIDs

Source: https://docs.doppler.com/docs/bitbucket-pipelines-doppler-cli

This script fetches deployment environments from Bitbucket and exposes their UUIDs as environment variables with a specific suffix. It requires `curl`, `jq`, and `eval` to be available.

```shell
# Compute Bitbucket API deployment environments endpoint
ENVIRONMENTS_ENDPOINT="https://api.bitbucket.org/2.0/repositories/$WORKPLACE/$REPO_SLUG/environments/"

# Fetch JSON and expose as environment variables with a `_BITBUCKET_ENV_UUID` suffix
eval $(curl -s -u "$WORKPLACE:$APP_PASSWORD" "https://api.bitbucket.org/2.0/repositories/$WORKPLACE/$REPO_SLUG/environments/" | jq -r '.values | to_entries[] | "export 	.value.category.name|=ascii_upcase|.value.category.name)_BITBUCKET_ENV_UUID=\" 	.value.uuid|=sub("\\{","%7B")|.value.uuid|=sub("\\}","%7D")|.value.uuid)"

# Confirm environment variables created
printenv | grep BITBUCKET_ENV_UUID
```

--------------------------------

### Mount .env file for PHP application

Source: https://docs.doppler.com/docs/accessing-secrets

Use the --mount flag to provide secrets as an .env file to your PHP application. The file is automatically cleaned up when the Doppler process exits.

```text
doppler run --mount .env -- php artisan serve
```

--------------------------------

### Docker Environment File with Process Substitution

Source: https://docs.doppler.com/docs/accessing-secrets

Use process substitution to supply secrets to a Docker container via the `--env-file` option without writing them to the file system.

```shell
docker run \
   --env-file <(doppler secrets download --no-file --format docker) \
    your/image
```

--------------------------------

### Run Command with Custom Fallback and Passphrase

Source: https://docs.doppler.com/docs/automatic-fallbacks

Execute a command using a fallback file at a specified path and decrypt it with a given passphrase. This is useful for pre-seeding fallback files in container images.

```shell
doppler run --fallback=/path/to/doppler.fallback.json --passphrase="your-passphrase-here" -- YOUR_COMMAND_HERE
```

--------------------------------

### Create SAML Property Mapping for User Email

Source: https://docs.doppler.com/docs/authentik-saml-sso

Use this mapping to send the user's email address to Doppler. The 'Expression' field should be set to `return request.user.email`.

```python
return request.user.email
```

--------------------------------

### Create a new Doppler config

Source: https://docs.doppler.com/docs/branch-configs

Use this command to create a new configuration branch for development.

```bash
doppler configs create dev_stripe_billing
```

--------------------------------

### List Secrets with Options

Source: https://docs.doppler.com/docs/accessing-secrets

View secrets with different output formats. Display names and values, only names, or names as a JSON array.

```shell
doppler secrets
```

```shell
doppler secrets --only-names
```

```shell
doppler secrets --only-names --json | jq keys
```

--------------------------------

### Run Doppler Commands in BuddyCI

Source: https://docs.doppler.com/docs/buddyci

Use this command in the 'Build Commands' field of your BuddyCI pipeline to execute commands with Doppler-injected environment variables. It runs `printenv` and filters for `DOPPLER` prefixed variables to verify secret injection.

```bash
doppler run -- printenv | grep DOPPLER
```

--------------------------------

### Upload Repository Variables to Doppler

Source: https://docs.doppler.com/docs/bitbucket-pipelines-doppler-cli

Feed repository variables to `doppler secrets upload` in environment variable format using curl and jq.

```shell
REPO_VARS_ENDPOINT="https://api.bitbucket.org/2.0/repositories/$WORKPLACE/$REPO_SLUG/pipelines_config/variables/"

# Import repository variables
doppler secrets upload <(curl -s -u "$WORKPLACE:$APP_PASSWORD" "$REPO_VARS_ENDPOINT" | jq -r '.values | to_entries[] | "\(.value.key)=\"\(.value.value)\""')
```

--------------------------------

### Run Command Using Only Fallback File

Source: https://docs.doppler.com/docs/automatic-fallbacks

Configure the Doppler CLI to exclusively fetch secrets from the encrypted fallback file, bypassing Doppler's API. This ensures secrets are only accessed from the local snapshot.

```shell
doppler run --fallback-only -- ./your-command-here
```

--------------------------------

### Download Secrets as .env File

Source: https://docs.doppler.com/docs/accessing-secrets

Download secrets in `.env` format and redirect the output to a file. It is recommended to avoid storing secrets unencrypted whenever possible.

```shell
# Avoid storing secrets unencrypted whenever possible
doppler secrets download --no-file --format env > .env
```

--------------------------------

### Run Build Script with Doppler Secrets

Source: https://docs.doppler.com/docs/azure-devops-pipelines

Executes a build script or command, injecting secrets from Doppler as environment variables. The DOPPLER_TOKEN must be explicitly mapped to an environment variable using the `env` field.

```yaml
  - script: doppler run -- ./bin/build.sh # Replace with your build command or script
    displayName: Build
    env:
      DOPPLER_TOKEN: $(DOPPLER_TOKEN)
```

--------------------------------

### Create SAML Property Mapping for User Name

Source: https://docs.doppler.com/docs/authentik-saml-sso

Use this mapping to send the user's name to Doppler. Ensure the 'Expression' field is correctly set to `return request.user.name`.

```python
return request.user.name
```

--------------------------------

### Mount custom file format with --mount-format

Source: https://docs.doppler.com/docs/accessing-secrets

Specify the format for a mounted secrets file using --mount-format when the file extension does not automatically map to a known format.

```shell
doppler run --mount app.config --mount-format json -- npm start
```

--------------------------------

### Fetch Doppler Secrets

Source: https://docs.doppler.com/docs/aws-ec2-oidc

Once authenticated, use the Doppler CLI to fetch secrets for a specific project and configuration.

```bash
doppler secrets --project my-app --config production
```

--------------------------------

### Run a command with a specific config

Source: https://docs.doppler.com/docs/branch-configs

Execute a command using secrets from a specified configuration. This allows testing features with branched configurations without changing the primary config.

```bash
doppler run -c dev_stripe_billing -- ./your-command-here
```

--------------------------------

### Auth0 SAML SSO Configuration JSON

Source: https://docs.doppler.com/docs/auth0-saml

Paste this JSON configuration into the Auth0 Settings text field. Remember to replace the placeholder URLs with your specific Doppler SAML configuration URLs.

```json
{
  "audience": "https://dashboard.doppler.com/login/sso/saml/metadata/$UUID",
  "recipient": "https://dashboard.doppler.com/login/sso/callback/$UUID",
  "destination": "https://dashboard.doppler.com/login/sso/callback/$UUID",
  "nameIdentifierFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
  "nameIdentifierProbes": [
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
  ],
  "mappings": {
    "name": "name"
  }
}
```

--------------------------------

### Load .env file with Python dotenv

Source: https://docs.doppler.com/docs/accessing-secrets

Adjust the usage of the python-dotenv package to load secrets from a mounted .env file by opening the file stream.

```python
with open ('.env') as env_file:
	 load_dotenv(stream=env_file)
```

--------------------------------

### Define Global Variables for CLI Import

Source: https://docs.doppler.com/docs/bitbucket-pipelines-doppler-cli

Define global variables required for automating the import of repository and deployment variables using bash and jq.

```bash
# Global variables used in all following commands
WORKPLACE="your-workplace"
APP_PASSWORD="your-app-password"
REPO_SLUG="your-repo-slug"
```

--------------------------------

### Verify Managing Service Principal Ownership with Azure CLI

Source: https://docs.doppler.com/docs/azure-service-principal

Use this command to confirm that the managing Service Principal has been successfully added as an owner to the target application. The output will be in a table format.

```bash
az ad app owner list --id <target-app-object-id> --query "[].{displayName:displayName, id:id}" -o table
```

--------------------------------

### Verify Managing Service Principal Ownership with Azure CLI

Source: https://docs.doppler.com/docs/azure-dynamic-service-principal

Verify that the managing Service Principal has been successfully added as an owner to the target application.

```bash
az ad app owner list --id <target-app-object-id> --query "[].{displayName:displayName, id:id}" -o table

```

--------------------------------

### Inject secrets as environment variables

Source: https://docs.doppler.com/docs/accessing-secrets

Inject secrets directly into your application's environment variables using the `doppler run` command. Be aware of potential security risks with certain environment variable names.

```text
doppler run -- npm start
```

--------------------------------

### Custom Secret Formatting with JQ

Source: https://docs.doppler.com/docs/accessing-secrets

Download secrets in JSON format and pipe them to `jq` to transform them into custom formats, such as Apache environment variables.

```shell
# Apache environment variable syntax
doppler secrets download --no-file | jq -r '. | to_entries[] | "SetEnv \(.key) \"\(.value)\""' > apache/env-vars.conf
```

--------------------------------

### Export DOPPLER_TOKEN on Linux

Source: https://docs.doppler.com/docs/asp-net-core-csharp

Set the DOPPLER_TOKEN environment variable for your Linux shell.

```text
export DOPPLER_TOKEN='dp.st.dev.xxxx'
```

--------------------------------

### Execute command with secrets as environment variables

Source: https://docs.doppler.com/docs/accessing-secrets

Use the `--command` flag with `doppler run` to execute a shell command that has access to secrets as environment variables. This is suitable for commands like `curl` with authentication.

```shell
doppler run --command='curl -u $USER:$TOKEN https://example.com'
```

--------------------------------

### Upload Lambda Environment Variables using Doppler CLI

Source: https://docs.doppler.com/docs/aws-lambda

Use the Doppler CLI to upload environment variables from an AWS Lambda function configuration. Ensure the Doppler project, config, and Lambda function name are correctly specified.

```shell
# Change the --project, --config and --function-name values for your code
doppler secrets upload --project lambda --config prd \
    <(aws lambda get-function-configuration --function-name doppler-test | jq .Environment.Variables)
```

--------------------------------

### Kubernetes Secret from Docker Format

Source: https://docs.doppler.com/docs/accessing-secrets

Create a Kubernetes secret using `kubectl` by leveraging process substitution with secrets downloaded in Docker format.

```shell
kubectl create secret generic \
	doppler-env-vars --from-env-file <(doppler secrets download --no-file --format docker)
```

--------------------------------

### Spawn Child Shell with Doppler Secrets

Source: https://docs.doppler.com/docs/accessing-secrets

Execute a new shell process spawned by the Doppler CLI, inheriting all secrets as environment variables. Exercise caution as all processes in this shell will have access to secrets.

```shell
doppler run -- sh -c 'bash'
```

```shell
doppler run -- sh -c 'zsh'
```

```shell
doppler run -- sh -c 'sh'
```

--------------------------------

### Mount .env file with limited reads for PHP

Source: https://docs.doppler.com/docs/accessing-secrets

Restrict the number of times a mounted secrets file can be read using --mount-max-reads. This is useful for operations like PHP configuration caching that only require a single read.

```shell
doppler run --mount .env --mount-max-reads 1 \
	--command="php artisan config:cache && php artisan serve"
```

--------------------------------

### Upload JSON Secrets to Doppler CLI

Source: https://docs.doppler.com/docs/aws-secrets-manager

Use this command to upload a JSON file containing secrets to Doppler. Ensure the DOPPLER_PROJECT_NAME and DOPPLER_CONFIG_NAME environment variables are set. The secrets are piped from the echo command.

```bash
doppler secrets upload --project $DOPPLER_PROJECT_NAME --config $DOPPLER_CONFIG_NAME <(echo "$SECRETS_JSON")
```

--------------------------------

### Auth0 Application Properties

Source: https://docs.doppler.com/docs/auth0-saml

Use this URL for the Application Logo in Auth0's Application Properties. Ensure you use a valid URL or upload your own logo.

```url
https://cdn.sanity.io/images/q3zajrd2/production/eb59a0d9476af5bf529c9af207071a5a45252628-400x400.png
```

--------------------------------

### Download Secrets with a Passphrase

Source: https://docs.doppler.com/docs/automatic-fallbacks

Download secrets to a fallback file using a specific passphrase. This allows decryption with any Doppler token that has project access, bypassing the default token-based encryption.

```shell
doppler secrets download --passphrase="your-passphrase-here"
```

--------------------------------

### Set a config as primary

Source: https://docs.doppler.com/docs/branch-configs

Configure the Doppler CLI to use a specific config for the current directory. Future commands will automatically use this config.

```bash
doppler configure set config=dev_stripe_billing
```

--------------------------------

### Mount JSON file for Node.js application

Source: https://docs.doppler.com/docs/accessing-secrets

Provide secrets in JSON format to your Node.js application by mounting a JSON file. The file is automatically deleted upon process termination.

```shell
doppler run --mount env.json -- npm start
```

--------------------------------

### Download Dynamic Secrets

Source: https://docs.doppler.com/docs/aws-iam

Download dynamic secrets and pipe them to jq for pretty printing. Note that AWS IAM credentials can take a few seconds to propagate.

```shell
doppler secrets download --no-file | jq .
{
  "AWS_USER_ACCESS_KEY_ID": "AKIXXXXXXXXXXXXI",
  "AWS_USER_ARN": "arn:aws:iam::36XXXXXXXX0:user/doppler/Doppler-Dynamic-yR9Y8hSHAzTwt",
  "AWS_USER_LEASE_EXPIRATION": "2022-02-15T17:04:54.782Z",
  "AWS_USER_LEASE_ID": "969eb8c9-f186-475b-8c32-3556de0aef21",
  "AWS_USER_POLICY_NAME": "doppler-policy-IsIklv03vqi12",
  "AWS_USER_SECRET_ACCESS_KEY": "RQ6R7aegXXXXXXXXXXXXMiJFdW/cPXXXXXoz",
  "AWS_USER_USERNAME": "Doppler-Dynamic-yR9Y8hSHAzTwt",
  "AWS_USER_USER_ID": "AXXAVKXXXXXXXXFOAO",
  "DOPPLER_CONFIG": "dev",
  "DOPPLER_ENVIRONMENT": "dev",
  "DOPPLER_PROJECT": "dynamic-secret"
}
```

--------------------------------

### Export Secrets to Current Shell (Bash)

Source: https://docs.doppler.com/docs/accessing-secrets

Promote Doppler local variables to environment variables in the current shell using `set -a` and `source` with process substitution. Use with caution.

```shell
set -a
source <(doppler secrets download --no-file --format env)
set +a
```

--------------------------------

### Run Command in Read-Only Fallback Mode

Source: https://docs.doppler.com/docs/automatic-fallbacks

Instruct the Doppler CLI to only read from an existing fallback file and never write a new one. This is suitable for environments with read-only file permissions.

```shell
doppler run --fallback-readonly -- ./your-command-here
```

--------------------------------

### Authenticate Doppler CLI with OIDC

Source: https://docs.doppler.com/docs/aws-ec2-oidc

Authenticate the Doppler CLI using the minted JWT and your Doppler Identity ID. Replace 'YOUR_DOPPLER_IDENTITY_ID' with your actual identity ID.

```bash
doppler oidc login \
  --scope=. \
  --identity=YOUR_DOPPLER_IDENTITY_ID \
  --token="$JWT"
```

--------------------------------

### Mount dynamic kubectl config

Source: https://docs.doppler.com/docs/accessing-secrets

Mount secrets to dynamically generate kubectl configuration files. This allows sensitive information like tokens to be securely supplied to kubectl commands.

```shell
KUBECONFIG=./kube-config doppler run \
  --mount kube-config \
  --mount-template ./kube-config.tmpl \
  -- kubectl get secrets
```

```text
{{.KUBE_CONFIG}}
```

--------------------------------

### Import Secrets from AWS Secrets Manager using Bash

Source: https://docs.doppler.com/docs/aws-secrets-manager

This script imports secrets from AWS Secrets Manager into Doppler. It checks for necessary CLI tools (jq, aws, doppler), retrieves secret values, processes them into JSON format (handling both JSON and plaintext secrets), and prepares them for Doppler. Ensure you configure the variables like DOPPLER_PROJECT_NAME and AWS_SECRET_ARN.

```bash
#!/bin/bash

# Check if jq is installed
if ! command -v jq &> /dev/null; then
    echo "jq could not be found, please install jq to process JSON data."
    exit 1
fi

# Check if aws is installed
if ! command -v aws &> /dev/null; then
    echo "aws could not be found, please install the aws CLI."
    exit 1
fi

# Check if doppler is installed
if ! command -v doppler &> /dev/null; then
    echo "doppler could not be found, please install the doppler CLI."
    exit 1
fi

# Configuration Variables
STRIP_SECRET_PATH="false" # strip path from secret name (e.g., changes 'some/path/secret-name' to 'secret-name')
DOPPLER_PROJECT_NAME="your-doppler-project-name"
DOPPLER_CONFIG_NAME="your-doppler-config-name"
AWS_SECRET_ARN="your-aws-secret-arn"

# Get the name of the secret from its metadata
secret_name=$(aws secretsmanager describe-secret --secret-id "$AWS_SECRET_ARN" --query 'Name' --output text)

# Strip the path from the secret name
if [ "$STRIP_SECRET_PATH" = "true" ]; then
    secret_name=$(echo "$secret_name" | awk -F/ '{print $NF}')
fi

# Convert secret name to uppercase and replace disallowed characters with underscores
NORMALIZED_SECRET_NAME=$(echo "$secret_name" | tr '[:lower:]' '[:upper:]' | sed 's/[^A-Z0-9]/_/g')

# Fetch the secret value from AWS Secrets Manager
secret_value=$(aws secretsmanager get-secret-value --secret-id "$AWS_SECRET_ARN" --query 'SecretString' --output text)

SECRETS_JSON=""
# Determine if the secret value is valid JSON
if echo "$secret_value" | jq -e . &> /dev/null; then
    # It's JSON, process all keys to uppercase and save
    SECRETS_JSON=$(echo "$secret_value" | jq 'with_entries(.key |= ascii_upcase)')
else
    # It's plaintext, use the formatted secret name
    SECRETS_JSON="{ \"$NORMALIZED_SECRET_NAME\": \"$secret_value\" }"
fi

# Check if the transformation was successful
if ! ( echo "$SECRETS_JSON" | jq -e . &> /dev/null ); then
    echo "Failed to process JSON data."
    exit 1
fi

```

--------------------------------

### Override Fallback File Path

Source: https://docs.doppler.com/docs/automatic-fallbacks

Specify a custom location for the Doppler fallback file. Ensure this path is added to your `.gitignore` if you are overriding it.

```shell
doppler run --fallback=/tmp -- ./your-command-here
```

--------------------------------

### Download Azure SP Secrets via CLI

Source: https://docs.doppler.com/docs/azure-dynamic-service-principal

Use `doppler secrets download` to retrieve Azure Service Principal credentials. The `--no-file` flag prevents writing to a file, and `jq` is used to parse the JSON output.

```shell
doppler secrets download --no-file | jq .
{
  "AZURE_SP_TENANT_ID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "AZURE_SP_CLIENT_ID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "AZURE_SP_CLIENT_SECRET": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "AZURE_SP_LEASE_EXPIRATION": "2026-03-10T18:00:00.000Z",
  "AZURE_SP_LEASE_ID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "DOPPLER_CONFIG": "dev",
  "DOPPLER_ENVIRONMENT": "dev",
  "DOPPLER_PROJECT": "my-project"
}

```

--------------------------------

### Authenticate with Doppler using OIDC

Source: https://docs.doppler.com/docs/aws-ec2-oidc

Log in to Doppler using the minted JWT. The `--identity` flag should be set to your Doppler service identity ID.

```bash
doppler oidc login \
  --scope=. \
  --identity="$DOPPLER_IDENTITY_ID" \
  --token="$JWT"
```

--------------------------------

### Inject Dynamic Secrets into a Shell

Source: https://docs.doppler.com/docs/aws-iam

Use `doppler run` to inject dynamic secrets into a new shell environment. The secrets will be available as environment variables.

```shell
doppler run -- zsh
printenv
...
AWS_USER_LEASE_ID=5d4a9800-7c7e-4009-9113-2a3dda2e9ff1
AWS_USER_LEASE_EXPIRATION=2022-02-15T17:15:16.586Z
AWS_USER_ACCESS_KEY_ID=AKIXXXXXXXXXXXXF6S
AWS_USER_POLICY_NAME=doppler-policy-sWQX6NpNVQHpv
AWS_USER_ARN=arn:aws:iam::366XXXXXXXXXXXX10:user/doppler/Doppler-Dynamic-0jflFuO4EXVZF
AWS_USER_USER_ID=AIDAVKXXXXXXXXXXXXFLP
AWS_USER_USERNAME=Doppler-Dynamic-0jflFuO4EXVZF
AWS_USER_SECRET_ACCESS_KEY=+Q7Z1myOJXXXXXXXXXXXX7tBR8cWdKjRAXXXXXXXXXXXXhB
```

--------------------------------

### Filter Secrets Using Grep

Source: https://docs.doppler.com/docs/accessing-secrets

Download secrets in environment variable format and filter them using `grep`. Useful for selecting secrets that contain specific strings or patterns.

```shell
doppler secrets download --no-file --format env | grep CLOUDWATCH
```

```shell
doppler secrets download --no-file --format env | grep ^CLOUDWATCH
```

--------------------------------

### Add Managing Service Principal as Owner with Azure CLI

Source: https://docs.doppler.com/docs/azure-service-principal

This command adds the managing Service Principal as an owner to the target application. Replace placeholders with actual IDs.

```bash
az ad app owner add --id <target-app-object-id> --owner-object-id <managing-sp-object-id>
```

--------------------------------

### Dynamic SSH Key Management with max reads

Source: https://docs.doppler.com/docs/accessing-secrets

Securely manage dynamic SSH private keys by mounting them with a limited number of reads. This ensures the key is deleted after use, enhancing security for SSH connections.

```shell
# Nested doppler run so the ssh command can use the SSH_USER and SSH_HOST env vars
# NOTE: The ssh command needs to read the private key twice
doppler run -- \
  doppler run \
    --mount ssh.key \
    --mount-template ssh.key.tmpl \
    --mount-max-reads 2 \
    --command 'ssh $SSH_USER@$SSH_HOST -i ssh.key'
```

```text
{{.SSH_KEY}}
```

--------------------------------

### Apply Name Transformers with Doppler Run

Source: https://docs.doppler.com/docs/accessing-secrets

Use the `--name-transformer` option with `doppler run` to alter secret naming conventions for specific applications like ASP.NET Core or Terraform.

```shell
# ASP.NET Core
doppler run --nane-transformer dotnet-env -- dotnet run
```

```shell
# Terraform
doppler run --name-transformer tf-var -- terraform apply
```

--------------------------------

### Mint JWT with AWS CLI

Source: https://docs.doppler.com/docs/aws-ec2-oidc

Use the AWS CLI to request a short-lived identity token (JWT) from STS. Ensure the --audience flag matches your Doppler configuration.

```bash
JWT=$(aws sts get-web-identity-token \
  --audience "doppler" \
  --signing-algorithm ES384 \
  --duration-seconds 300 \
  --query 'WebIdentityToken' \
  --output text)
```

--------------------------------

### Enable Auto Restart for a Command

Source: https://docs.doppler.com/docs/automatic-restart

Pass the `--watch` flag to the `doppler run` command to enable automatic process restarts when secrets change. Your command will execute immediately, and the CLI will then monitor for secret updates.

```shell
doppler run --watch -- ./your_command.sh
```

--------------------------------

### Check for Invalid Auth Token

Source: https://docs.doppler.com/docs/automatic-fallbacks

Use this to test if your auth token is invalid before running a command. It pipes the output of 'printenv' to grep and checks the exit status.

```shell
doppler run --fallback doppler.encrypted.json -- printenv 2>&1 | grep  -q 'Invalid Auth token'

if [ $? == 0 ]; then
  echo '[error]: Token invalid. Exiting'
  exit 1
fi

doppler run --fallback doppler.encrypted.json -- your-command
```

--------------------------------

### Configure Custom Doppler Identity Provider

Source: https://docs.doppler.com/docs/aws-ec2-oidc

Set the Discovery URL to your AWS account's issuer URL and the Audience to 'doppler'. The Subject should be your IAM role's ARN.

```text
https://96e40952-de33-4e54-a532-d0c9b6136950.tokens.sts.global.api.aws
```

```text
arn:aws:iam::123456789012:role/ec2-doppler-oidc
```

--------------------------------

### Filter Secrets Using JQ

Source: https://docs.doppler.com/docs/accessing-secrets

Download secrets in JSON format and filter them using `jq`. This allows for more complex filtering based on keys and values.

```shell
doppler secrets download --no-file --format json | \
    jq -r '. | to_entries[] | select(.key | contains("CLOUDWATCH)")) | { (.key): (.value)}" | \
    jq -s add
```

```shell
doppler secrets download --no-file --format json | \
    jq -r '. | to_entries[] | select(.key | startswith("CLOUDWATCH")) | { (.key): (.value)}" | \
    jq -s add
```

--------------------------------

### Update root configs and delete branched config

Source: https://docs.doppler.com/docs/branch-configs

Add secrets to root configurations (development, staging, production) and then remove the feature-specific branched config once it's no longer needed.

```bash
# Add secret to Development Root Config
doppler secrets set -c dev STRIPE_API_KEY=sk_test_9YxLnoLDdvOPn2dfjBVPB

# Add secret to Staging Root Config
doppler secrets set -c stg STRIPE_API_KEY=sk_test_9YxLnoLDdvOPn2dfjBVPB

# Add secret to Production Root Config
doppler secrets set -c prd STRIPE_API_KEY=sk_live_SinMsVYhdHurkdOrVKWCd

# Delete branched config
doppler configs delete dev_stripe_billing
```

--------------------------------

### Run Command with Custom Secret Expiration

Source: https://docs.doppler.com/docs/automatic-fallbacks

Define a custom expiration time for secrets and clean them up before running a command. This ensures secrets are not stale.

```shell
doppler run clean --max-age 24h

# Will fail if fallback file was cleaned up
doppler run --fallback doppler.encrypted.json -- your-command
```

--------------------------------

### Fetch Secrets in C# ASP.NET Core

Source: https://docs.doppler.com/docs/asp-net-core-csharp

This C# code fetches secrets from the Doppler API using the DOPPLER_TOKEN environment variable. Ensure the token has read-only access to the desired project and config. The secrets are deserialized into a Doppler object.

```csharp
using System;
using System.Net.Http;
using System.Text;
using System.Text.Json;
using System.Text.Json.Serialization;
using System.Threading.Tasks;

namespace DopplerExamples
{
    public class Doppler
    {
        [JsonPropertyName("DOPPLER_PROJECT")]
        public string DopplerProject { get; set; }

        [JsonPropertyName("DOPPLER_ENVIRONMENT")]
        public string DopplerEnvironment { get; set; }

        [JsonPropertyName("DOPPLER_CONFIG")]
        public string DopplerConfig { get; set; }

        private static HttpClient client = new HttpClient();

        public static async Task<Doppler> FetchSecretsAsync()
        {
            var dopplerToken = Environment.GetEnvironmentVariable("DOPPLER_TOKEN");

            client.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", dopplerToken);
            var streamTask = client.GetStreamAsync("https://api.doppler.com/v3/configs/config/secrets/download?format=json");
            var secrets = await JsonSerializer.DeserializeAsync<Doppler>(await streamTask);

            return secrets;
        }
    }

    class Program
    {
        static async Task Main()
        {
            var secrets = await Doppler.FetchSecretsAsync();

            Console.WriteLine($"Project: {secrets.DopplerProject}");
            Console.WriteLine($"Environment: {secrets.DopplerEnvironment}");
            Console.WriteLine($"Config: {secrets.DopplerConfig}");
        }
    }
}
```

--------------------------------

### Complete EC2 User Data Script

Source: https://docs.doppler.com/docs/aws-ec2-oidc

A complete bash script suitable for EC2 user data, cron jobs, or systemd services to automate Doppler authentication.

```bash
#!/usr/bin/env bash
set -euo pipefail

DOPPLER_IDENTITY_ID="YOUR_DOPPLER_IDENTITY_ID"

```

--------------------------------

### Set Doppler Service Token

Source: https://docs.doppler.com/docs/aws-lambda

Export the Doppler Service Token as an environment variable to authenticate the Doppler CLI for CI/CD jobs. This token provides read-only access to a specific Doppler configuration.

```shell
export DOPPLER_TOKEN=dp.st.prd.xxxx
```

--------------------------------

### Sync Doppler Secrets to AWS Lambda Environment Variables

Source: https://docs.doppler.com/docs/accessing-secrets

Update AWS Lambda function configuration with secrets from Doppler by formatting them as JSON environment variables.

```shell
aws lambda update-function-configuration \
    --function-name doppler-test \
    --environment $(echo "{"Variables":$(doppler secrets download --no-file)}")
```

--------------------------------

### Mount .env file for Node.js application

Source: https://docs.doppler.com/docs/accessing-secrets

Mount secrets as an .env file for your Node.js application using the --mount flag. This ephemeral file is removed after the process finishes.

```shell
doppler run --mount .env -- npm start
```

--------------------------------

### Add Managing Service Principal as Owner with Azure CLI

Source: https://docs.doppler.com/docs/azure-dynamic-service-principal

This command adds the managing Service Principal as an owner to the target application, a necessary step when the 'Application.ReadWrite.OwnedBy' permission is used.

```bash
az ad app owner add --id <target-app-object-id> --owner-object-id <managing-sp-object-id>

```

--------------------------------

### Extend Dynamic Secret Lease TTL

Source: https://docs.doppler.com/docs/aws-iam

Extend the lease time for dynamic secrets beyond the default 30 minutes by specifying a `--dynamic-ttl` value. 's' for seconds and 'h' for hours are supported.

```shell
date -u && doppler secrets download --dynamic-ttl 3h --no-file \
        | jq ."AWS_USER_LEASE_EXPIRATION"
Tue Feb 15 17:08:37 UTC 2022
"2022-02-15T20:08:37.868Z"
```

--------------------------------

### Parse JSON Secrets in Go

Source: https://docs.doppler.com/docs/aws-ecs

This Go program parses the DOPPLER_SECRETS environment variable. It includes error handling for missing variables and JSON parsing errors. Secrets are accessed as a map.

```go
package main

import (
	"encoding/json"
	"fmt"
	"os"
)

func main() {
	dopplerSecrets := os.Getenv("DOPPLER_SECRETS")

	if dopplerSecrets == "" {
		fmt.Println("DOPPLER_SECRETS environment variable isn't set")
		return
	}

	var secrets map[string]interface{}
	err := json.Unmarshal([]byte(dopplerSecrets), &secrets)
	if err != nil {
		fmt.Printf("Error parsing DOPPLER_SECRETS: %s\n", err)
		return
	}

	apiKey, ok := secrets["API_KEY"]
	if ok {
		fmt.Printf("API_KEY: %v\n", apiKey)
	} else {
		fmt.Println("API_KEY not found in secrets")
	}
}
```

--------------------------------

### AWS Lambda IAM Policy for Configuration

Source: https://docs.doppler.com/docs/aws-lambda

This policy grants the necessary permissions to update and retrieve Lambda function configurations, specifically for environment variables.

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "LambdaConfig",
            "Effect": "Allow",
            "Action": [
                "lambda:UpdateFunctionConfiguration",
                "lambda:GetFunctionConfiguration"
            ],
            "Resource": "*"
        }
    ]
}
```

--------------------------------

### Set DOPPLER_TOKEN in Windows Shell

Source: https://docs.doppler.com/docs/asp-net-core-csharp

Set the DOPPLER_TOKEN environment variable for your Windows command prompt.

```shell
SET VAR_NAME=dp.st.dev.xxxx
```

--------------------------------

### Mount custom template for Firebase config

Source: https://docs.doppler.com/docs/accessing-secrets

Use a custom template to mount secrets for specific application configurations, such as Firebase Cloud Functions emulator. The template defines how secrets are formatted in the mounted file.

```shell
doppler run \
  --mount .runtimeconfig.json \
  --mount-template .runtimeconfig.tmpl -- \
  firebase emulators:start --only functions
```

```text
{ "doppler": {{tojson .}} }
```

--------------------------------

### AWS IAM Policy for SSM Access with Tag Updates

Source: https://docs.doppler.com/docs/aws-parameter-store

This policy allows for standard SSM parameter management and includes actions for managing tags on resources, useful for organization and automation.

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowSSMAccess",
            "Effect": "Allow",
            "Action": [
                "ssm:PutParameter",
                "ssm:LabelParameterVersion",
                "ssm:DeleteParameter",
                "ssm:RemoveTagsFromResource",
                "ssm:GetParameterHistory",
                "ssm:AddTagsToResource",
                "ssm:ListTagsForResource",
                "ssm:RemoveTagsFromResource",
                "ssm:GetParametersByPath",
                "ssm:GetParameters",
                "ssm:GetParameter",
                "ssm:DeleteParameters"
            ],
            "Resource": "*"
        }
    ]
}
```

--------------------------------

### Set DOPPLER_TOKEN in PowerShell

Source: https://docs.doppler.com/docs/asp-net-core-csharp

Set the DOPPLER_TOKEN environment variable for your PowerShell session.

```powershell
$env:DOPPLER_TOKEN = 'dp.st.dev.xxxx'
```

--------------------------------

### Parse JSON Secrets in Python

Source: https://docs.doppler.com/docs/aws-ecs

Use this Python snippet to load secrets from the DOPPLER_SECRETS environment variable and access specific keys like API_KEY. Ensure the DOPPLER_SECRETS variable is set.

```python
import os
import json

secrets = json.loads(os.environ['DOPPLER_SECRETS'])
api_key = secrets['API_KEY']
print(api_key)
```

--------------------------------

### Scope Doppler Identity to Specific EC2 Instance

Source: https://docs.doppler.com/docs/aws-ec2-oidc

Use JSON Pointer syntax to scope the identity to a specific EC2 instance by providing its ARN as the value for the 'ec2_source_instance_arn' claim key.

```text
/https:~1~1sts.amazonaws.com~1/ec2_source_instance_arn
```

```text
arn:aws:ec2:us-east-1:123456789012:instance/i-0abc123def456789
```

--------------------------------

### AWS IAM Policy for Standard SSM Access

Source: https://docs.doppler.com/docs/aws-parameter-store

This policy grants Doppler permissions to manage SSM parameters. Ensure this is used when not employing a custom KMS key.

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowSSMAccess",
            "Effect": "Allow",
            "Action": [
                "ssm:PutParameter",
                "ssm:LabelParameterVersion",
                "ssm:DeleteParameter",
                "ssm:RemoveTagsFromResource",
                "ssm:GetParameterHistory",
                "ssm:AddTagsToResource",
                "ssm:GetParametersByPath",
                "ssm:GetParameters",
                "ssm:GetParameter",
                "ssm:DeleteParameters"
            ],
            "Resource": "*"
        }
    ]
}
```

--------------------------------

### Parse JSON Secrets in Ruby

Source: https://docs.doppler.com/docs/aws-ecs

Use this Ruby snippet to parse the DOPPLER_SECRETS environment variable into a hash. Access secrets using string keys. Ensure the variable is set before parsing.

```ruby
require "json"

secrets = JSON.parse(ENV["DOPPLER_SECRETS"])
api_key = secrets["API_KEY"]
puts api_key
```

--------------------------------

### AWS Lambda Function Code (Node.js)

Source: https://docs.doppler.com/docs/aws-lambda

A simple Node.js Lambda function that retrieves API_KEY and DB_URL environment variables synced from Doppler and returns them in a config object.

```javascript
exports.handler = async function(event, context) {
  const config = {
      'API_KEY': process.env.API_KEY,
      'DB_URL': process.env.DB_URL
  }
  
  return config;
}
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.