Troubleshooting

Check a machine first

On the machine, with its two lines set, read the environment without writing anything, and print only its first line, so no value lands on the screen:

mybeast-secrets pull --out - | head -n 1

It says which project and environment the token reads, and the latest change it got:

# MyBeast Secrets · shop/production · change #12 · 4 variables · 27.10.2026 14:05 UTC

Compare it with the environment's History tab. If the command stops instead, its message says why: the CLI's messages list each one with its fix.

The token is refused

the token was refused: revoked, mistyped, or not a token of …, or 401 from the API. One of these:

• It was revoked. The Tokens page lists it under Revoked. Make a new one.
• It's incomplete. A token is st_, a public part, a dot and a secret. Set both lines again from where you kept them.
• The address is another one. MYBEAST_SECRETS_URL must be https://services.my-beast.com/secrets.
• Its environment was removed at id. The Tokens page lists it under No environment: it reads nothing. Revoke it, and make one for an environment that exists.

A token can't be shown again, so if you've lost it, make a new one and revoke the old: Rotate a token.

A pull won't overwrite the .env

.env was not written by mybeast-secrets; move it away, or pull with --force to overwrite it

The .env there doesn't start with the line Secrets writes, so the CLI won't risk a hand-made file. Import that file first, so nothing in it is lost: see Import a .env. Then move it away and pull, or pull with --force.

A server still has the old value

• It hasn't read since the change. On the Tokens page its token says Behind. Pull again, or restart what run started.
• The app read its configuration when it started. Restart it after a pull.
• Laravel's configuration is cached. Run php artisan config:cache again after each pull.
• The change went to another environment. A change is made in one environment only. Check the first line of the check above, and the History tab of the environment it names.

A variable is missing on a server

• It's in another environment only. The environment's list shows it under Missing here, with a way to add it: see Compare environments.
• Its line was skipped in an import. A name such as app_key isn't UPPER_SNAKE, and an import skips it: see Why a line is skipped.
• It was removed. The History tab shows the removal, which can be rolled back.

Too many reads

too many reads just now; try again in a minute, or 429 from the API. A token reads at most 120 times a minute, and one address 300 times. That's usually a process that restarts in a loop under run: fix what makes it exit, or pull once and start it without run.

You can't open production

“You don't open production in Secrets”: your role gives you No access in production, though you may open the other environments. Roles are made by the workspace's owners and admins at id.my-beast.com, and a project's admins give them to people: see Production environments.

You can't make a token

• There's no Make a token button. Making tokens takes Admin in the project.
• Production isn't offered. Its tokens take Admin in production.
• An environment can't be picked. It has 10 active tokens already. Revoke one it no longer needs.

An import is refused

• “The text changed after it was checked”: the box was edited after Check. Look at what it would do now, then import.
• “Nothing to import”: every line is skipped or has the same value already.
• Too big: a pasted .env is at most 256 KB. Import it in parts.
• Over the package's limit: the new names don't fit in the environment. See Past a limit.