doppler

Troubleshooting

If requests fail, run zero doctor check-connector --env-name DOPPLER_TOKEN or zero doctor check-connector --url https://api.doppler.com/v3/configs/config/secret --method GET

Core APIs

Fetch a Single Secret by Name

curl -s "https://api.doppler.com/v3/configs/config/secret" \
  -H "Authorization: Bearer $DOPPLER_TOKEN" \
  -G \
  --data-urlencode "project=<project-slug>" \
  --data-urlencode "config=<config-name>" \
  --data-urlencode "name=<SECRET_NAME>" | jq '{name: .secret.name, raw: .secret.value.raw, computed: .secret.value.computed}'

Replace <project-slug> with your Doppler project slug, <config-name> with the config (e.g., dev, prd), and <SECRET_NAME> with the exact secret key.

List All Secrets in a Config

curl -s "https://api.doppler.com/v3/configs/config/secrets" \
  -H "Authorization: Bearer $DOPPLER_TOKEN" \
  -G \
  --data-urlencode "project=<project-slug>" \
  --data-urlencode "config=<config-name>" | jq '.secrets | to_entries[] | {name: .key, raw: .value.raw, computed: .value.computed}'

Download All Secrets as JSON

curl -s "https://api.doppler.com/v3/configs/config/secrets/download" \
  -H "Authorization: Bearer $DOPPLER_TOKEN" \
  -G \
  --data-urlencode "project=<project-slug>" \
  --data-urlencode "config=<config-name>" \
  --data-urlencode "format=json"

Returns a flat key/value JSON object of all secrets.

List Projects

curl -s "https://api.doppler.com/v3/projects" \
  -H "Authorization: Bearer $DOPPLER_TOKEN" | jq '.projects[] | {id, name, slug}'

List Configs in a Project

curl -s "https://api.doppler.com/v3/configs" \
  -H "Authorization: Bearer $DOPPLER_TOKEN" \
  -G \
  --data-urlencode "project=<project-slug>" | jq '.configs[] | {name, environment, locked}'

Guidelines

1. Service Token scope: A dp.st.* token is scoped to a single project + config. It cannot access other projects.
2. Project slug: Find via "List Projects". This is the URL-safe identifier, not the display name.
3. Config name: Typically matches the environment name (e.g., dev, staging, prd). List configs to verify.
4. raw vs. computed: raw is the stored value; computed has variable references resolved.
5. Rate limits: Doppler imposes per-token rate limits on the free plan. Avoid polling in tight loops.
6. Security: Service tokens grant read (and optionally write) access to all secrets in the scoped config. Rotate them regularly.