doppler: could not fetch secrets" cli error
Fixes the Doppler CLI failing with 'could not fetch secrets': check project, config, and token scope. Use when doppler run or doppler secrets fail to fetch. Not for Doppler dashboard issues.
TL;DR
The CLI cannot fetch when it is pointed at the wrong project or config, or its token lacks access. Verify the selected project and config, re-authenticate, and confirm the token's scope covers the environment.
Error
"doppler: could not fetch secrets" cli errorSteps
- Run the CLI's project/config check to see what it thinks is selected. Expected: the intended project and config names.
- If wrong, set them explicitly for the directory or pass them as flags. Expected: the selection matches the dashboard.
- Re-authenticate the CLI to refresh the token. Expected: a fresh token.
- Check the token scope covers the environment you are fetching. Expected: scope includes it.
- Retry the fetch. Expected: secrets return.
When to use
- Doppler CLI fetch failures in terminal or CI.
- After renames or environment changes.
When not to use
- Dashboard or API issues unrelated to the CLI.
- Secrets exist but have wrong values (data issue, not fetch).
Tool compatibility
- Doppler CLI; project/config scoping.
Variant phrasings
doppler could not retrieve secrets
Same triage.
doppler unauthorized fetching secrets
Token or scope.
Why it happens
The CLI resolves project and config from local state that drifts after renames, and tokens are scoped per environment.
Edge cases
- Service tokens are per-config; a token for dev cannot read prod.
- Network egress rules can block the CLI while the dashboard works.
- Stale CLI versions fail against newer APIs; update the CLI.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_IXvRoFSY4IjliZtXGELODw