How to set an encrypted configuration value using the standard Magento CLI?

Question

I'm trying to use the Magento2 config:sensitive:set CLI command to set a sensitive configuration value, but Magento is throwing the following error:

There are no sensitive configurations to fill

I've already searched the web, came across one Magento stackexchange question, and another one, as well as a Magento2 GitHub issue, but none of the suggested answers worked for me.

Saving via the admin panel works fine, I'm looking to make use of the core Magento config:sensitive:set CLI command.

The field is defined as obscure, it's added to Magento\Config\Model\Config\TypePool as sensitive, and also the backend model assigned in config.xml:

system.xml file:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Config:etc/system_file.xsd">
    <system>
        <section id="tax">
            <group id="my_custom_group" translate="label" sortOrder="150" showInDefault="1" showInWebsite="1" showInStore="0">
                <field id="my_field" translate="label" type="obscure" sortOrder="300" showInDefault="1" showInWebsite="1" showInStore="0">
                    <label>some label</label>
                    <backend_model>Magento\Config\Model\Config\Backend\Encrypted</backend_model>
                </field>
            </group>
        </section>
    </system>
</config>

di.xml file:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
    <type name="Magento\Config\Model\Config\TypePool">
        <arguments>
            <argument name="sensitive" xsi:type="array">
                <item name="tax/my_custom_group/my_field" xsi:type="string">1</item>
            </argument>
        </arguments>
    </type>
</config>

config.xml file:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
    <default>
        <tax>
            <my_custom_group>
                <my_field backend_model="Magento\Config\Model\Config\Backend\Encrypted"/>
            </my_custom_group>
        </tax>
    </default>
</config>

Anyone got this working??

Answer 1

You have to run app:config:dump to export sensitive configs to app/etc/env.php, then you are able to run config:sensitive:set command.

Answer 2

After a bit of research of my own, on a clean Magento 2.4.4 installation, it turns out that I mixed two separate issues in my question.

My investigation showed that:

One thing is setting encrypted configuration values, which depends only on the configuration of the backend_model in system.xml, and can be done by both the config:set as well as the config:sensitive:set commands. However, once the fields are locked after running app:config:dump or after using config:set with the --lock-env option, in order to change the value with config:set you must use the --lock-env option (config:sensitve:set will still work fine).

Another thing is using the config:sensitive:set command: as stated by @TuVan, it can be used only after the app:config:dump command was used.

I'm not sure what would be the exact use case of using config:sensitive:set, when I can always use config:set --lock-env, but that's out of the scope of this question :-)