I'm trying to use the Magento2 config:sensitive:set CLI command to set a sensitive configuration value, but Magento is throwing the following error:

There are no sensitive configurations to fill

I've already searched the web, came across one Magento stackexchange question, and another one, as well as a Magento2 GitHub issue, but none of the suggested answers worked for me.

Saving via the admin panel works fine, I'm looking to make use of the core Magento config:sensitive:set CLI command.

The field is defined as obscure, it's added to Magento\Config\Model\Config\TypePool as sensitive, and also the backend model assigned in config.xml:

system.xml file:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Config:etc/system_file.xsd">
        <section id="tax">
            <group id="my_custom_group" translate="label" sortOrder="150" showInDefault="1" showInWebsite="1" showInStore="0">
                <field id="my_field" translate="label" type="obscure" sortOrder="300" showInDefault="1" showInWebsite="1" showInStore="0">
                    <label>some label</label>

di.xml file:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
    <type name="Magento\Config\Model\Config\TypePool">
            <argument name="sensitive" xsi:type="array">
                <item name="tax/my_custom_group/my_field" xsi:type="string">1</item>

config.xml file:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
                <my_field backend_model="Magento\Config\Model\Config\Backend\Encrypted"/>

Anyone got this working??

2 Answers 2


You have to run app:config:dump to export sensitive configs to app/etc/env.php, then you are able to run config:sensitive:set command.


After a bit of research of my own, on a clean Magento 2.4.4 installation, it turns out that I mixed two separate issues in my question.

My investigation showed that:

One thing is setting encrypted configuration values, which depends only on the configuration of the backend_model in system.xml, and can be done by both the config:set as well as the config:sensitive:set commands. However, once the fields are locked after running app:config:dump or after using config:set with the --lock-env option, in order to change the value with config:set you must use the --lock-env option (config:sensitve:set will still work fine).

Another thing is using the config:sensitive:set command: as stated by @TuVan, it can be used only after the app:config:dump command was used.

I'm not sure what would be the exact use case of using config:sensitive:set, when I can always use config:set --lock-env, but that's out of the scope of this question :-)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.