Generating values

OneGuard generates random values using the same character sets and defaults as the generator in the dashboard.

There are two commands, and the difference matters:

| | Where the value goes | Who sees it | | --- | --- | --- | | oneguard generate | printed to stdout, stored nowhere | your terminal, your shell history, your CI log | | oneguard secrets generate | straight into a stored secret | nobody — it is never printed |

If the value is destined for a secret anyway, use secrets generate. It leaves no copy behind.

generate

Generate a value locally and print it. No network call, no login required.

oneguard generate
oneguard generate --length 32
oneguard generate --count 5 --no-special

Because it prints one value per line, it composes with a shell:

export DB_PASSWORD=$(oneguard generate --length 32)

| Option | Default | | | --- | --- | --- | | -l, --length | 16 | Number of characters | | -c, --count | 1 | How many values to generate | | --[no-]lowercase | on | Include a-z | | --[no-]uppercase | on | Include A-Z | | --[no-]numbers | on | Include 0-9 | | --[no-]special | on | Include !@#%^&*()-_=+[]{}\|;:,.<>? | | --min-numbers | 2 | Minimum digits in the value | | --min-special | 2 | Minimum special characters |

The command fails rather than quietly producing something weaker than you asked for: disabling every character class is an error, and so is asking for minimums that do not fit in --length.

secrets generate

Generate a value and push it into a secret under a given key.

oneguard secrets generate --project <vault> --id <secret> --key DB_PASSWORD
oneguard secrets generate --project <vault> --id <secret> --key API_TOKEN \
  --length 48 --no-special

Added "DB_PASSWORD" in secret "production" (4 variables total).
Value not shown. Run 'oneguard env pull --project <vault> --id <secret>' to write it to a file.

This merges. The stored payload is fetched and decrypted, the one key is set, and everything is re-encrypted and sent back — every other variable in the secret survives. That is the difference from secrets edit, which replaces the whole payload.

| Option | | | | --- | --- | --- | | --project | required | Vault id or 8-character prefix | | --id | required | Secret id or 8-character prefix | | -k, --key | required | The variable name to set, e.g. DB_PASSWORD | | --force | | Replace the key if it already exists | | --show | | Also print the generated value. Off by default, deliberately |

Without --force, writing to a key that already exists is an error rather than a silent overwrite.

Every option from generate above applies here too.