usr/local/bin/doctl -access-token='$(secret-tool lookup Title my-secret)' this as adoctl, make it executable and move it to a location in your path, e.g.: chmod 755 adoctl I wrote a small wrapper around doctl that passes the secret as accesstoken and named it adoctl (for 'authenticated doctl'): #!/bin/bash Now you should be able to query your secrets with secret-tool: secret-tool lookup Title my-secret Click on 'Secret Service Integration' on the left and select the groups you want to expose.

Click on the 'Edit database settings' icon for the database in which you want to expose secrets.Tick the 'Enable KeepassXC Secret Service integration' checkbox.Navigate to Settings -> Secret Service Integration.(optional) Create a secret titled 'my-secret' in this group.(optional) Create a new group for secrets you want to expose to secret-tool and add the secrets to this group.So as a first step, i had to get the accesstoken from my unlocked KeepassXC database.

yaml file.ĭoctl has a -t option to pass in the accesstoken as a parameter. So even though my harddrive is encrypted, i didnt want an accesstoken gaining full access to my DigitalOcean account laying around in some. I didnt want DigitalOcean's doctl to store my accesstoken in its config.yaml file, since i have all secrets regarding technical infrastructure in a seperate KeepassXC database.

Keepassxc github