doppler-workflows

# Doppler Credential Workflows > **Self-Evolving Skill**: This skill improves through use. If instructions are wrong, parameters drifted, or a workaround was needed — fix this file immediately, don't defer. Only update for real, reproducible issues. ## When to Use This Skill Use this skill when: - Publishing Python packages to PyPI - Rotating AWS access keys - Managing credentials across multiple services - Troubleshooting authentication failures (403, InvalidClientTokenId) - Setting up Doppler credential injection patterns - Multi-token/multi-account strategies ## Quick Reference ## Core Pattern: Doppler CLI **Standard Usage:** ```bash doppler run --project <project> --config <config> --command='<command>' ``` **Why --command flag:** - Official Doppler pattern (auto-detects shell) - Ensures variables expand AFTER Doppler injects them - Without it: shell expands `$VAR` before Doppler runs → empty string --- ## Quick Start Examples ### PyPI Publishing ```bash doppler run --project claude-config --config dev \ --command='uv publish --token "$PYPI_TOKEN"' ``` ### AWS Operations ```bash doppler run --project aws-credentials --config dev \ --command='aws s3 ls --region $AWS_DEFAULT_REGION' ``` --- ## Best Practices 1. Always use --command flag for credential injection 2. Use project-scoped tokens (PyPI) for better security 3. Rotate credentials regularly (90 days recommended) 4. Document with Doppler notes: `doppler secrets notes set <SECRET> "<note>"` 5. Us...