Temporary token

v3.0.0+

The tcb secrets command has been available since v3.0.0.

The tcb secrets get command is used to obtain temporary keys (secretId / secretKey / token) for the current Web login session, facilitating direct initialization of @cloudbase/manager-node or @cloudbase/node-sdk during development and debugging without manual configuration.

Security Restrictions

• Only supports output of temporary keys (obtained via tcb login Web login)
• Permanent keys entered via tcb login --key cannot be output, and this behavior cannot be bypassed.
• Once a permanent key is compromised, the impact is permanent. Do not use it for this command.

tcb secrets get

Obtain temporary keys for the current login session.

tcb secrets get [options]

Parameters

Parameter	Description
-e, --env-id <envId>	Bind environment ID (appended to the output for initializing the SDK)
--json	Output JSON (suitable for script consumption)

Example

# View current temporary keys
tcb secrets get

# Specify the environment ID (the output will include envId)
tcb secrets get -e my-env-id

# JSON Format (Suitable for Reading in Scripts and Initializing the SDK)
tcb secrets get --json -e my-env-id

JSON Output Format

{
  "secretId": "AKID...",
  "secretKey": "xxx",
  "token": "yyy",
  "expiredAt": "2026-03-30 22:00:00",
  "isTemporary": true,
  "envId": "my-env-id"
}

---

Use Case: Initialize SDK

After obtaining temporary credentials, you can directly initialize the CloudBase SDK in local scripts or tools for debugging and automation:

// @cloudbase/manager-node
const CloudBase = require('@cloudbase/manager-node')
const app = new CloudBase({
  secretId: '<secretId>',
  secretKey: '<secretKey>',
  token: '<token>',
  envId: 'my-env-id'
})

// @cloudbase/node-sdk
const tcb = require('@cloudbase/node-sdk')
const app = tcb.init({
  secretId: '<secretId>',
  secretKey: '<secretKey>',
  token: '<token>',
  env: 'my-env-id'
})

Security Notice

Do not commit temporary credentials to code repositories or paste them in public forums. Temporary credentials are time-sensitive and will expire automatically.

---

Related Commands

• tcb login — Login authentication
• tcb env list — View available environments