Repository: superfly/flyctl
Pull request #4388 (2025-05-21 05:13:22)

use new secret keys api from fly-go for managing secret keys in `flyctl secrets keys`.
### Change Summary

What and Why: The flaps API that was previously used for managing secret keys was requisitioned for managing app secrets, and a new flaps API was added for managing secret keys. This PR restores functionality to flyctl by using the new API instead of the API that no longer works for managing secret keys.

How: Use latest fly-go flaps client code.

Related to:

---

### Documentation

- [ ] Fresh Produce
- [ ] In superfly/docs, or asked for help from docs team
- [ x ] n/a



Patch:
diff --git a/go.mod b/go.mod
index 5004d1a5d..6ad779e56 100644
--- a/go.mod
+++ b/go.mod
@@ -75,7 +75,7 @@ require (
 	github.com/spf13/pflag v1.0.6
 	github.com/spf13/viper v1.20.1
 	github.com/stretchr/testify v1.10.0
-	github.com/superfly/fly-go v0.1.45
+	github.com/superfly/fly-go v0.1.46
 	github.com/superfly/graphql v0.2.6
 	github.com/superfly/lfsc-go v0.1.1
 	github.com/superfly/macaroon v0.3.0
diff --git a/go.sum b/go.sum
index f2c477299..1b93b7694 100644
--- a/go.sum
+++ b/go.sum
@@ -628,8 +628,8 @@ github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOf
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/superfly/fly-go v0.1.45 h1:mLcl2N9Y/+4OXMHXXFzrlmkfm0WHncOjhgEuRt/gIVQ=
-github.com/superfly/fly-go v0.1.45/go.mod h1:YcVyr0bQm6cdydoMsqIHDPZDQqbmErwCSIuJI4pNwZM=
+github.com/superfly/fly-go v0.1.46 h1:Se4nPu+6NNgIzrVofz6yZy1DCXSYSGrEirTj/MXdHq4=
+github.com/superfly/fly-go v0.1.46/go.mod h1:YcVyr0bQm6cdydoMsqIHDPZDQqbmErwCSIuJI4pNwZM=
 github.com/superfly/graphql v0.2.6 h1:zppbodNerWecoXEdjkhrqaNaSjGqobhXNlViHFuZzb4=
 github.com/superfly/graphql v0.2.6/go.mod h1:CVfDl31srm8HnJ9udwLu6hFNUW/P6GUM2dKcG1YQ8jc=
 github.com/superfly/lfsc-go v0.1.1 h1:dGjLgt81D09cG+aR9lJZIdmonjZSR5zYCi7s54+ZU2Q=
diff --git a/internal/command/secrets/key_delete.go b/internal/command/secrets/key_delete.go
index 0d37323fb..53fb41d65 100644
--- a/internal/command/secrets/key_delete.go
+++ b/internal/command/secrets/key_delete.go
@@ -57,7 +57,7 @@ func runKeyDelete(ctx context.Context) (err error) {
 		return err
 	}
 
-	secrets, err := flapsClient.ListSecrets(ctx)
+	secrets, err := flapsClient.ListSecretKeys(ctx, nil)
 	if err != nil {
 		return err
 	}
@@ -66,7 +66,7 @@ func runKeyDelete(ctx context.Context) (err error) {
 	var rerr error
 	out := iostreams.FromContext(ctx).Out
 	for _, secret := range secrets {
-		ver2, prefix2, err := SplitLabelKeyver(secret.Label)
+		ver2, prefix2, err := SplitLabelKeyver(secret.Name)
 		if err != nil {
 			continue
 		}
@@ -87,7 +87,7 @@ func runKeyDelete(ctx context.Context) (err error) {
 		}
 
 		if !flag.GetBool(ctx, "force") {
-			confirm, err := prompt.Confirm(ctx, fmt.Sprintf("delete secrets key %s?", secret.Label))
+			confirm, err := prompt.Confirm(ctx, fmt.Sprintf("delete secrets key %s?", secret.Name))
 			if err != nil {
 				rerr = errors.Join(rerr, err)
 				continue
@@ -97,15 +97,15 @@ func runKeyDelete(ctx context.Context) (err error) {
 			}
 		}
 
-		err = flapsClient.DeleteSecret(ctx, secret.Label)
+		err = flapsClient.DeleteSecretKey(ctx, secret.Name)
 		if err != nil {
 			var ferr *flaps.FlapsError
 			if errors.As(err, &ferr) && ferr.ResponseStatusCode == 404 {
 				err = fmt.Errorf("not found")
 			}
-			rerr = errors.Join(rerr, fmt.Errorf("deleting %v: %w", secret.Label, err))
+			rerr = errors.Join(rerr, fmt.Errorf("deleting %v: %w", secret.Name, err))
 		} else {
-			fmt.Fprintf(out, "Deleted %v\n", secret.Label)
+			fmt.Fprintf(out, "Deleted %v\n", secret.Name)
 		}
 	}
 	return rerr
diff --git a/internal/command/secrets/key_set.go b/internal/command/secrets/key_set.go
index 0f5aaf0fe..de369cf41 100644
--- a/internal/command/secrets/key_set.go
+++ b/internal/command/secrets/key_set.go
@@ -6,7 +6,6 @@ import (
 	"fmt"
 
 	"github.com/spf13/cobra"
-	fly "github.com/superfly/fly-go"
 	"github.com/superfly/flyctl/internal/command"
 	"github.com/superfly/flyctl/internal/flag"
 	"github.com/superfly/flyctl/iostreams"
@@ -84,7 +83,7 @@ func runKeySetOrGenerate(ctx context.Context) (err error) {
 		return err
 	}
 
-	secrets, err := flapsClient.ListSecrets(ctx)
+	secrets, err := flapsClient.ListSecretKeys(ctx, nil)
 	if err != nil {
 		return err
 	}
@@ -93,13 +92,13 @@ func runKeySetOrGenerate(ctx context.Context) (err error) {
 	// while finding the highest version with the same prefix.
 	bestVer := KeyverUnspec
 	for _, secret := range secrets {
-		if label == secret.Label {
+		if label == secret.Name {
 			if !flag.GetBool(ctx, "force") {
 				return fmt.Errorf("refusing to overwrite existing key")
 			}
 		}
 
-		ver2, prefix2, err := SplitLabelKeyver(secret.Label)
+		ver2, prefix2, err := SplitLabelKeyver(secret.Name)
 		if err != nil {
 			continue
 		}
@@ -111,7 +110,7 @@ func runKeySetOrGenerate(ctx context.Context) (err error) {
 		semType2, _ := SecretTypeToSemanticType(secret.Type)
 		if semType2 != semType {
 			typs := secretTypeToString(secret.Type)
-			return fmt.Errorf("key %v (%v) has conflicting type %v (%v)", prefix, secret.Label, semType2, typs)
+			return fmt.Errorf("key %v (%v) has conflicting type %v (%v)", prefix, secret.Name, semType2, typs)
 		}
 
 		if CompareKeyver(ver2, bestVer) > 0 {
@@ -136,9 +135,9 @@ func runKeySetOrGenerate(ctx context.Context) (err error) {
 	}
 
 	if gen {
-		err = flapsClient.GenerateSecret(ctx, label, typ)
+		_, err = flapsClient.GenerateSecretKey(ctx, label, typ)
 	} else {
-		err = flapsClient.CreateSecret(ctx, label, typ, fly.CreateSecretRequest{Value: val})
+		_, err = flapsClient.SetSecretKey(ctx, label, typ, val)
 	}
 	if err != nil {
 		return err
diff --git a/internal/command/secrets/keys.go b/internal/command/secrets/keys.go
index af254987e..adec24e60 100644
--- a/internal/command/secrets/keys.go
+++ b/internal/command/secrets/keys.go
@@ -17,14 +17,14 @@ import (
 type SecretType = string
 
 const (
-	SECRET_TYPE_KMS_HS256          = fly.SECRET_TYPE_KMS_HS256
-	SECRET_TYPE_KMS_HS384          = fly.SECRET_TYPE_KMS_HS384
-	SECRET_TYPE_KMS_HS512          = fly.SECRET_TYPE_KMS_HS512
-	SECRET_TYPE_KMS_XAES256GCM     = fly.SECRET_TYPE_KMS_XAES256GCM
-	SECRET_TYPE_KMS_NACL_AUTH      = fly.SECRET_TYPE_KMS_NACL_AUTH
-	SECRET_TYPE_KMS_NACL_BOX       = fly.SECRET_TYPE_KMS_NACL_BOX
-	SECRET_TYPE_KMS_NACL_SECRETBOX = fly.SECRET_TYPE_KMS_NACL_SECRETBOX
-	SECRET_TYPE_KMS_NACL_SIGN      = fly.SECRET_TYPE_KMS_NACL_SIGN
+	SECRETKEY_TYPE_HS256          = fly.SECRETKEY_TYPE_HS256
+	SECRETKEY_TYPE_HS384          = fly.SECRETKEY_TYPE_HS384
+	SECRETKEY_TYPE_HS512          = fly.SECRETKEY_TYPE_HS512
+	SECRETKEY_TYPE_XAES256GCM     = fly.SECRETKEY_TYPE_XAES256GCM
+	SECRETKEY_TYPE_NACL_AUTH      = fly.SECRETKEY_TYPE_NACL_AUTH
+	SECRETKEY_TYPE_NACL_BOX       = fly.SECRETKEY_TYPE_NACL_BOX
+	SECRETKEY_TYPE_NACL_SECRETBOX = fly.SECRETKEY_TYPE_NACL_SECRETBOX
+	SECRETKEY_TYPE_NACL_SIGN      = fly.SECRETKEY_TYPE_NACL_SIGN
 )
 
 func newKeys() *cobra.Command {
diff --git a/internal/command/secrets/keys_common.go b/internal/command/secrets/keys_common.go
index d7c1c7baf..f2dde4be6 100644
--- a/internal/command/secrets/keys_common.go
+++ b/internal/command/secrets/keys_common.go
@@ -25,18 +25,18 @@ type KeyTypeInfo struct {
 // In this list, the most preferred types are listed first.
 var supportedKeyTypes = []KeyTypeInfo{
 	// Preferred key types:
-	{SECRET_TYPE_KMS_NACL_AUTH, SemTypeSigning},
-	{SECRET_TYPE_KMS_NACL_SECRETBOX, SemTypeEncrypting},
+	{SECRETKEY_TYPE_NACL_AUTH, SemTypeSigning},
+	{SECRETKEY_TYPE_NACL_SECRETBOX, SemTypeEncrypting},
 
 	// Also supported key types:
-	{SECRET_TYPE_KMS_HS256, SemTypeSigning},
-	{SECRET_TYPE_KMS_HS384, SemTypeSigning},
-	{SECRET_TYPE_KMS_HS512, SemTypeSigning},
-	{SECRET_TYPE_KMS_XAES256GCM, SemTypeEncrypting},
+	{SECRETKEY_TYPE_HS256, SemTypeSigning},
+	{SECRETKEY_TYPE_HS384, SemTypeSigning},
+	{SECRETKEY_TYPE_HS512, SemTypeSigning},
+	{SECRETKEY_TYPE_XAES256GCM, SemTypeEncrypting},
 
 	// Unsupported:
-	// SECRET_TYPE_KMS_NACL_BOX, SemTypePublicEncrypting
-	// SECRET_TYPE_KMS_NACL_SIGN, SmeTypePublicSigning
+	// SECRETKEY_TYPE_NACL_BOX, SemTypePublicEncrypting
+	// SECRETKEY_TYPE_NACL_SIGN, SmeTypePublicSigning
 }
 
 // SupportedSecretTypes is a list of the SecretTypes for supported key types.
diff --git a/internal/command/secrets/keys_list.go b/internal/command/secrets/keys_list.go
index b253a68f0..7ba543411 100644
--- a/internal/command/secrets/keys_list.go
+++ b/internal/command/secrets/keys_list.go
@@ -36,12 +36,12 @@ name and version.`
 	return cmd
 }
 
-func compareSecrets(a, b fly.ListSecret) int {
-	aver, aprefix, err1 := SplitLabelKeyver(a.Label)
+func compareSecrets(a, b fly.SecretKey) int {
+	aver, aprefix, err1 := SplitLabelKeyver(a.Name)
 	if err1 != nil {
 		return -1
 	}
-	bver, bprefix, err2 := SplitLabelKeyver(b.Label)
+	bver, bprefix, err2 := SplitLabelKeyver(b.Name)
 	if err2 != nil {
 		return 1
 	}
@@ -71,7 +71,7 @@ func runKeysList(ctx context.Context) (err error) {
 		return err
 	}
 
-	secrets, err := flapsClient.ListSecrets(ctx)
+	secrets, err := flapsClient.ListSecretKeys(ctx, nil)
 	if err != nil {
 		return err
 	}
@@ -85,12 +85,12 @@ func runKeysList(ctx context.Context) (err error) {
 			continue
 		}
 
-		ver, prefix, err := SplitLabelKeyver(secret.Label)
+		ver, prefix, err := SplitLabelKeyver(secret.Name)
 		if err != nil {
 			continue
 		}
 		jsecret := jsonSecret{
-			Label:   secret.Label,
+			Label:   secret.Name,
 			Name:    prefix,
 			Version: ver.String(),
 			SemType: string(semType),
diff --git a/internal/flapsutil/flaps_client.go b/internal/flapsutil/flaps_client.go
index f33faeb5e..c789d9dcb 100644
--- a/internal/flapsutil/flaps_client.go
+++ b/internal/flapsutil/flaps_client.go
@@ -15,17 +15,17 @@ type FlapsClient interface {
 	AcquireLease(ctx context.Context, machineID string, ttl *int) (*fly.MachineLease, error)
 	Cordon(ctx context.Context, machineID string, nonce string) (err error)
 	CreateApp(ctx context.Context, name string, org string) (err error)
-	CreateSecret(ctx context.Context, sLabel, sType string, in fly.CreateSecretRequest) (err error)
 	CreateVolume(ctx context.Context, req fly.CreateVolumeRequest) (*fly.Volume, error)
 	CreateVolumeSnapshot(ctx context.Context, volumeId string) error
 	DeleteMetadata(ctx context.Context, machineID, key string) error
-	DeleteSecret(ctx context.Context, label string) (err error)
+	DeleteAppSecret(ctx context.Context, name string) error
+	DeleteSecretKey(ctx context.Context, name string) error
 	DeleteVolume(ctx context.Context, volumeId string) (*fly.Volume, error)
 	Destroy(ctx context.Context, input fly.RemoveMachineInput, nonce string) (err error)
 	Exec(ctx context.Context, machineID string, in *fly.MachineExecRequest) (*fly.MachineExecResponse, error)
 	ExtendVolume(ctx context.Context, volumeId string, size_gb int) (*fly.Volume, bool, error)
 	FindLease(ctx context.Context, machineID string) (*fly.MachineLease, error)
-	GenerateSecret(ctx context.Context, sLabel, sType string) (err error)
+	GenerateSecretKey(ctx context.Context, name string, typ string) (*fly.SetSecretKeyResp, error)
 	Get(ctx context.Context, machineID string) (*fly.Machine, error)
 	GetAllVolumes(ctx context.Context) ([]fly.Volume, error)
 	GetMany(ctx context.Context, machineIDs []string) ([]*fly.Machine, error)
@@ -39,11 +39,14 @@ type FlapsClient interface {
 	List(ctx context.Context, state string) ([]*fly.Machine, error)
 	ListActive(ctx context.Context) ([]*fly.Machine, error)
 	ListFlyAppsMachines(ctx context.Context) ([]*fly.Machine, *fly.Machine, error)
-	ListSecrets(ctx context.Context) (out []fly.ListSecret, err error)
+	ListAppSecrets(ctx context.Context, version *uint64, showSecrets bool) ([]fly.AppSecret, error)
+	ListSecretKeys(ctx context.Context, version *uint64) ([]fly.SecretKey, error)
 	NewRequest(ctx context.Context, method, path string, in interface{}, headers map[string][]string) (*http.Request, error)
 	RefreshLease(ctx context.Context, machineID string, ttl *int, nonce string) (*fly.MachineLease, error)
 	ReleaseLease(ctx context.Context, machineID, nonce string) error
 	Restart(ctx context.Context, in fly.RestartMachineInput, nonce string) (err error)
+	SetAppSecret(ctx context.Context, name string, value string) (*fly.SetAppSecretResp, error)
+	SetSecretKey(ctx context.Context, name string, typ string, value []byte) (*fly.SetSecretKeyResp, error)
 	SetMetadata(ctx context.Context, machineID, key, value string) error
 	Start(ctx context.Context, machineID string, nonce string) (out *fly.MachineStartResponse, err error)
 	Stop(ctx context.Context, in fly.StopMachineInput, nonce string) (err error)
diff --git a/internal/inmem/flaps_client.go b/internal/inmem/flaps_client.go
index 8eb40a42d..4020ab2c2 100644
--- a/internal/inmem/flaps_client.go
+++ b/internal/inmem/flaps_client.go
@@ -36,10 +36,6 @@ func (m *FlapsClient) CreateApp(ctx context.Context, name string, org string) (e
 	panic("TODO")
 }
 
-func (m *FlapsClient) CreateSecret(ctx context.Context, sLabel, sType string, in fly.CreateSecretRequest) (err error) {
-	panic("TODO")
-}
-
 func (m *FlapsClient) CreateVolume(ctx context.Context, req fly.CreateVolumeRequest) (*fly.Volume, error) {
 	panic("TODO")
 }
@@ -52,7 +48,11 @@ func (m *FlapsClient) DeleteMetadata(ctx context.Context, machineID, key string)
 	panic("TODO")
 }
 
-func (m *FlapsClient) DeleteSecret(ctx context.Context, label string) (err error) {
+func (m *FlapsClient) DeleteAppSecret(ctx context.Context, name string) error {
+	panic("TODO")
+}
+
+func (m *FlapsClient) DeleteSecretKey(ctx context.Context, name string) error {
 	panic("TODO")
 }
 
@@ -76,7 +76,7 @@ func (m *FlapsClient) FindLease(ctx context.Context, machineID string) (*fly.Mac
 	panic("TODO")
 }
 
-func (m *FlapsClient) GenerateSecret(ctx context.Context, sLabel, sType string) (err error) {
+func (m *FlapsClient) GenerateSecretKey(ctx context.Context, name string, typ string) (*fly.SetSecretKeyResp, error) {
 	panic("TODO")
 }
 
@@ -152,7 +152,11 @@ func (m *FlapsClient) ListFlyAppsMachines(ctx context.Context) (machines []*fly.
 	return machines, releaseCmdMachine, nil
 }
 
-func (m *FlapsClient) ListSecrets(ctx context.Context) (out []fly.ListSecret, err error) {
+func (m *FlapsClient) ListAppSecrets(ctx context.Context, version *uint64, showSecrets bool) ([]fly.AppSecret, error) {
+	panic("TODO")
+}
+
+func (m *FlapsClient) ListSecretKeys(ctx context.Context, version *uint64) ([]fly.SecretKey, error) {
 	panic("TODO")
 }
 
@@ -176,6 +180,14 @@ func (m *FlapsClient) SetMetadata(ctx context.Context, machineID, key, value str
 	panic("TODO")
 }
 
+func (m *FlapsClient) SetAppSecret(ctx context.Context, name string, value string) (*fly.SetAppSecretResp, error) {
+	panic("TODO")
+}
+
+func (m *FlapsClient) SetSecretKey(ctx context.Context, name string, typ string, value []byte) (*fly.SetSecretKeyResp, error) {
+	panic("TODO")
+}
+
 func (m *FlapsClient) Start(ctx context.Context, machineID string, nonce string) (out *fly.MachineStartResponse, err error) {
 	panic("TODO")
 }
diff --git a/internal/mock/flaps_client.go b/internal/mock/flaps_client.go
index e6dc8ad23..1fb87d824 100644
--- a/internal/mock/flaps_client.go
+++ b/internal/mock/flaps_client.go
@@ -15,17 +15,17 @@ type FlapsClient struct {
 	AcquireLeaseFunc         func(ctx context.Context, machineID string, ttl *int) (*fly.MachineLease, error)
 	CordonFunc               func(ctx context.Context, machineID string, nonce string) (err error)
 	CreateAppFunc            func(ctx context.Context, name string, org string) (err error)
-	CreateSecretFunc         func(ctx context.Context, sLabel, sType string, in fly.CreateSecretRequest) (err error)
 	CreateVolumeFunc         func(ctx context.Context, req fly.CreateVolumeRequest) (*fly.Volume, error)
 	CreateVolumeSnapshotFunc func(ctx context.Context, volumeId string) error
 	DeleteMetadataFunc       func(ctx context.Context, machineID, key string) error
-	DeleteSecretFunc         func(ctx context.Context, label string) (err error)
+	DeleteAppSecretFunc      func(ctx context.Context, name string) error
+	DeleteSecretKeyFunc      func(ctx context.Context, name string) error
 	DeleteVolumeFunc         func(ctx context.Context, volumeId string) (*fly.Volume, error)
 	DestroyFunc              func(ctx context.Context, input fly.RemoveMachineInput, nonce string) (err error)
 	ExecFunc                 func(ctx context.Context, machineID string, in *fly.MachineExecRequest) (*fly.MachineExecResponse, error)
 	ExtendVolumeFunc         func(ctx context.Context, volumeId string, size_gb int) (*fly.Volume, bool, error)
 	FindLeaseFunc            func(ctx context.Context, machineID string) (*fly.MachineLease, error)
-	GenerateSecretFunc       func(ctx context.Context, sLabel, sType string) (err error)
+	GenerateSecretKeyFunc    func(ctx context.Context, name string, typ string) (*fly.SetSecretKeyResp, error)
 	GetFunc                  func(ctx context.Context, machineID string) (*fly.Machine, error)
 	GetAllVolumesFunc        func(ctx context.Context) ([]fly.Volume, error)
 	GetManyFunc              func(ctx context.Context, machineIDs []string) ([]*fly.Machine, error)
@@ -39,12 +39,15 @@ type FlapsClient struct {
 	ListFunc                 func(ctx context.Context, state string) ([]*fly.Machine, error)
 	ListActiveFunc           func(ctx context.Context) ([]*fly.Machine, error)
 	ListFlyAppsMachinesFunc  func(ctx context.Context) ([]*fly.Machine, *fly.Machine, error)
-	ListSecretsFunc          func(ctx context.Context) (out []fly.ListSecret, err error)
+	ListAppSecretsFunc       func(ctx context.Context, version *uint64, showSecrets bool) ([]fly.AppSecret, error)
+	ListSecretKeysFunc       func(ctx context.Context, version *uint64) ([]fly.SecretKey, error)
 	NewRequestFunc           func(ctx context.Context, method, path string, in interface{}, headers map[string][]string) (*http.Request, error)
 	RefreshLeaseFunc         func(ctx context.Context, machineID string, ttl *int, nonce string) (*fly.MachineLease, error)
 	ReleaseLeaseFunc         func(ctx context.Context, machineID, nonce string) error
 	RestartFunc              func(ctx context.Context, in fly.RestartMachineInput, nonce string) (err error)
 	SetMetadataFunc          func(ctx context.Context, machineID, key, value string) error
+	SetAppSecretFunc         func(ctx context.Context, name string, value string) (*fly.SetAppSecretResp, error)
+	SetSecretKeyFunc         func(ctx context.Context, name string, typ string, value []byte) (*fly.SetSecretKeyResp, error)
 	StartFunc                func(ctx context.Context, machineID string, nonce string) (out *fly.MachineStartResponse, err error)
 	StopFunc                 func(ctx context.Context, in fly.StopMachineInput, nonce string) (err error)
 	SuspendFunc              func(ctx context.Context, machineID, nonce string) (err error)
@@ -67,10 +70,6 @@ func (m *FlapsClient) CreateApp(ctx context.Context, name string, org string) (e
 	return m.CreateAppFunc(ctx, name, org)
 }
 
-func (m *FlapsClient) CreateSecret(ctx context.Context, sLabel, sType string, in fly.CreateSecretRequest) (err error) {
-	return m.CreateSecretFunc(ctx, sLabel, sType, in)
-}
-
 func (m *FlapsClient) CreateVolume(ctx context.Context, req fly.CreateVolumeRequest) (*fly.Volume, error) {
 	return m.CreateVolumeFunc(ctx, req)
 }
@@ -83,8 +82,12 @@ func (m *FlapsClient) DeleteMetadata(ctx context.Context, machineID, key string)
 	return m.DeleteMetadataFunc(ctx, machineID, key)
 }
 
-func (m *FlapsClient) DeleteSecret(ctx context.Context, label string) (err error) {
-	return m.DeleteSecretFunc(ctx, label)
+func (m *FlapsClient) DeleteAppSecret(ctx context.Context, name string) (err error) {
+	return m.DeleteAppSecretFunc(ctx, name)
+}
+
+func (m *FlapsClient) DeleteSecretKey(ctx context.Context, name string) (err error) {
+	return m.DeleteSecretKeyFunc(ctx, name)
 }
 
 func (m *FlapsClient) DeleteVolume(ctx context.Context, volumeId string) (*fly.Volume, error) {
@@ -107,8 +110,8 @@ func (m *FlapsClient) FindLease(ctx context.Context, machineID string) (*fly.Mac
 	return m.FindLeaseFunc(ctx, machineID)
 }
 
-func (m *FlapsClient) GenerateSecret(ctx context.Context, sLabel, sType string) (err error) {
-	return m.GenerateSecretFunc(ctx, sLabel, sType)
+func (m *FlapsClient) GenerateSecretKey(ctx context.Context, name string, typ string) (*fly.SetSecretKeyResp, error) {
+	return m.GenerateSecretKeyFunc(ctx, name, typ)
 }
 
 func (m *FlapsClient) Get(ctx context.Context, machineID string) (*fly.Machine, error) {
@@ -163,8 +166,12 @@ func (m *FlapsClient) ListFlyAppsMachines(ctx context.Context) ([]*fly.Machine,
 	return m.ListFlyAppsMachinesFunc(ctx)
 }
 
-func (m *FlapsClient) ListSecrets(ctx context.Context) (out []fly.ListSecret, err error) {
-	return m.ListSecretsFunc(ctx)
+func (m *FlapsClient) ListAppSecrets(ctx context.Context, version *uint64, showSecrets bool) (out []fly.AppSecret, err error) {
+	return m.ListAppSecretsFunc(ctx, version, showSecrets)
+}
+
+func (m *FlapsClient) ListSecretKeys(ctx context.Context, version *uint64) (out []fly.SecretKey, err error) {
+	return m.ListSecretKeysFunc(ctx, version)
 }
 
 func (m *FlapsClient) NewRequest(ctx context.Context, method, path string, in interface{}, headers map[string][]string) (*http.Request, error) {
@@ -187,6 +194,14 @@ func (m *FlapsClient) SetMetadata(ctx context.Context, machineID, key, value str
 	return m.SetMetadataFunc(ctx, machineID, key, value)
 }
 
+func (m *FlapsClient) SetAppSecret(ctx context.Context, name string, value string) (*fly.SetAppSecretResp, error) {
+	return m.SetAppSecretFunc(ctx, name, value)
+}
+
+func (m *FlapsClient) SetSecretKey(ctx context.Context, name string, typ string, value []byte) (*fly.SetSecretKeyResp, error) {
+	return m.SetSecretKeyFunc(ctx, name, typ, value)
+}
+
 func (m *FlapsClient) Start(ctx context.Context, machineID string, nonce string) (out *fly.MachineStartResponse, err error) {
 	return m.StartFunc(ctx, machineID, nonce)
 }


Test patch:
diff --git a/internal/command/deploy/mock_client_test.go b/internal/command/deploy/mock_client_test.go
index 92430d13b..bcfdb4daa 100644
--- a/internal/command/deploy/mock_client_test.go
+++ b/internal/command/deploy/mock_client_test.go
@@ -46,10 +46,6 @@ func (m *mockFlapsClient) CreateApp(ctx context.Context, name string, org string
 	return fmt.Errorf("failed to create app %s", name)
 }
 
-func (m *mockFlapsClient) CreateSecret(ctx context.Context, sLabel, sType string, in fly.CreateSecretRequest) (err error) {
-	return fmt.Errorf("failed to create secret %s", sLabel)
-}
-
 func (m *mockFlapsClient) CreateVolume(ctx context.Context, req fly.CreateVolumeRequest) (*fly.Volume, error) {
 	return nil, fmt.Errorf("failed to create volume %s", req.Name)
 }
@@ -62,8 +58,12 @@ func (m *mockFlapsClient) DeleteMetadata(ctx context.Context, machineID, key str
 	return fmt.Errorf("failed to delete metadata %s", key)
 }
 
-func (m *mockFlapsClient) DeleteSecret(ctx context.Context, label string) (err error) {
-	return fmt.Errorf("failed to delete secret %s", label)
+func (m *mockFlapsClient) DeleteAppSecret(ctx context.Context, name string) error {
+	return fmt.Errorf("failed to delete app secret %s", name)
+}
+
+func (m *mockFlapsClient) DeleteSecretKey(ctx context.Context, name string) error {
+	return fmt.Errorf("failed to delete secret key %s", name)
 }
 
 func (m *mockFlapsClient) DeleteVolume(ctx context.Context, volumeId string) (*fly.Volume, error) {
@@ -89,8 +89,9 @@ func (m *mockFlapsClient) FindLease(ctx context.Context, machineID string) (*fly
 	return nil, fmt.Errorf("failed to find lease for %s", machineID)
 }
 
-func (m *mockFlapsClient) GenerateSecret(ctx context.Context, sLabel, sType string) (err error) {
-	return fmt.Errorf("failed to generate secret %s", sLabel)
+func (m *mockFlapsClient) GenerateSecretKey(ctx context.Context, name string, typ string) (*fly.SetSecretKeyResp, error) {
+
+	return nil, fmt.Errorf("failed to generate app secret %s", name)
 }
 
 func (m *mockFlapsClient) Get(ctx context.Context, machineID string) (*fly.Machine, error) {
@@ -158,8 +159,12 @@ func (m *mockFlapsClient) ListFlyAppsMachines(ctx context.Context) ([]*fly.Machi
 	return nil, nil, fmt.Errorf("failed to list fly apps machines")
 }
 
-func (m *mockFlapsClient) ListSecrets(ctx context.Context) (out []fly.ListSecret, err error) {
-	return nil, fmt.Errorf("failed to list secrets")
+func (m *mockFlapsClient) ListAppSecrets(ctx context.Context, version *uint64, showSecrets bool) ([]fly.AppSecret, error) {
+	return nil, fmt.Errorf("failed to list app secrets")
+}
+
+func (m *mockFlapsClient) ListSecretKeys(ctx context.Context, version *uint64) ([]fly.SecretKey, error) {
+	return nil, fmt.Errorf("failed to list secret keys")
 }
 
 func (m *mockFlapsClient) NewRequest(ctx context.Context, method, path string, in interface{}, headers map[string][]string) (*http.Request, error) {
@@ -209,6 +214,14 @@ func (m *mockFlapsClient) SetMetadata(ctx context.Context, machineID, key, value
 	return nil
 }
 
+func (m *mockFlapsClient) SetAppSecret(ctx context.Context, name string, value string) (*fly.SetAppSecretResp, error) {
+	return nil, fmt.Errorf("failed to set app secret %s", name)
+}
+
+func (m *mockFlapsClient) SetSecretKey(ctx context.Context, name string, typ string, value []byte) (*fly.SetSecretKeyResp, error) {
+	return nil, fmt.Errorf("failed to set secret key %s", name)
+}
+
 func (m *mockFlapsClient) Start(ctx context.Context, machineID string, nonce string) (out *fly.MachineStartResponse, err error) {
 	return nil, fmt.Errorf("failed to start %s", machineID)
 }