OCLI password encryption: move credentials between environments without reconfiguration

With Orchestration CLI password encryption, you can now export credential definitions with a portable, user-controlled key — importing them into any HCL Universal Orchestrator environment without touching the password fields.

Promoting credential definitions from development to staging — or from an on-premises deployment to a cloud installation — produced export files with passwords encrypted under the source system key. The destination environment rejected those fields on import because each HCL Universal Orchestrator installation uses a unique internal system key. The Orchestration CLI ;password option changes that: exported password fields carry the {aes-user} prefix encrypted with a key you control, decryptable on any installation that has the same key.

One export file that works on any installation

Appending ;password to the item specification at export time replaces the system-bound {aes} prefix with {aes-user}. Because the encryption key is provided by you rather than derived from the installation, the exported file imports without modification into any other HCL Universal Orchestrator environment. The key must be between 8 and 64 characters.

Keep the key out of the terminal, out of the logs

Set the WA_EXPORT_PWD environment variable before the export command and Orchestration CLI reads the key without it appearing in the shell history or terminal output. Recommended for automated pipelines and CI/CD setups. For interactive sessions, Orchestration CLI prompts for the key and does not echo it. The inline ;password=key form is available but may expose the key in shell history and is not recommended for production environments.

Backward-compatible import, no existing automation to rewrite

On import, Orchestration CLI detects the encryption prefix automatically and applies the appropriate decryption method. Files using the existing {aes} prefix continue to import without any additional option. Only files that cross environment boundaries need the ;password option at export time. No existing automation scripts require changes unless they handle definitions destined for a different installation.

For the full key provision precedence, supported prefix reference, and command syntax, see Encrypting passwords during model export and import.