forget

monkeys forget [@profile] <KEY>
monkeys forget @profile[,profile...]
monkeys forget +namespace

Deletes one secret from the vault. Inside a project the key is the project's; @ reaches one with no profile from there:

monkeys forget OPENROUTER_API_KEY
monkeys forget @ TYPESAFE_API_KEY

The .monkeys file is not touched: a project still lists the key, and doctor reports it missing until someone stores a secret for it again.

A key that .monkeys holds as a value for the profile has its line deleted instead, since the file says which of the two it is:

monkeys forget API_URL

forgot API_URL from .monkeys for @test

A value the file sets for several profiles together is refused, the way set --public refuses it.

A profile on its own, with no key, forgets every secret stored under it, and a comma list forgets several. The names are all resolved before anything is deleted, so a typo in the second name leaves the first untouched:

monkeys forget @test,production

forgot @test: DATABASE_URL, STRIPE_SECRET_KEY
forgot @production: DATABASE_URL, SENTRY_DSN, STRIPE_SECRET_KEY

A namespace forgets every profile under it, declared in a file or not:

monkeys forget +foo

forgot @foo.production: DATABASE_URL, SENTRY_DSN, STRIPE_SECRET_KEY
forgot @foo.test: DATABASE_URL, STRIPE_SECRET_KEY

Neither form touches .monkeys: a project still declares the profile, and doctor reports every key of it missing. A bare @ is no profile and is refused, so the secrets with no profile go one key at a time.