diff --git a/pkg/cli/credential.go b/pkg/cli/credential.go
index cb0e698b..5f617941 100644
--- a/pkg/cli/credential.go
+++ b/pkg/cli/credential.go
@@ -26,6 +26,7 @@ func (c *Credential) Customize(cmd *cobra.Command) {
 	cmd.Short = "List stored credentials"
 	cmd.Args = cobra.NoArgs
 	cmd.AddCommand(cmd2.Command(&Delete{root: c.root}))
+	cmd.AddCommand(cmd2.Command(&Show{root: c.root}))
 }
 
 func (c *Credential) Run(_ *cobra.Command, _ []string) error {
@@ -68,7 +69,7 @@ func (c *Credential) Run(_ *cobra.Command, _ []string) error {
 		defer w.Flush()
 
 		if c.ShowEnvVars {
-			_, _ = w.Write([]byte("CONTEXT\tTOOL\tENVIRONMENT VARIABLES\n"))
+			_, _ = w.Write([]byte("CONTEXT\tCREDENTIAL\tENVIRONMENT VARIABLES\n"))
 
 			for _, cred := range creds {
 				envVars := make([]string, 0, len(cred.Env))
@@ -79,7 +80,7 @@ func (c *Credential) Run(_ *cobra.Command, _ []string) error {
 				_, _ = fmt.Fprintf(w, "%s\t%s\t%s\n", cred.Context, cred.ToolName, strings.Join(envVars, ", "))
 			}
 		} else {
-			_, _ = w.Write([]byte("CONTEXT\tTOOL\n"))
+			_, _ = w.Write([]byte("CONTEXT\tCREDENTIAL\n"))
 			for _, cred := range creds {
 				_, _ = fmt.Fprintf(w, "%s\t%s\n", cred.Context, cred.ToolName)
 			}
@@ -93,7 +94,7 @@ func (c *Credential) Run(_ *cobra.Command, _ []string) error {
 		if c.ShowEnvVars {
 			w := tabwriter.NewWriter(os.Stdout, 10, 1, 3, ' ', 0)
 			defer w.Flush()
-			_, _ = w.Write([]byte("TOOL\tENVIRONMENT VARIABLES\n"))
+			_, _ = w.Write([]byte("CREDENTIAL\tENVIRONMENT VARIABLES\n"))
 
 			for _, cred := range creds {
 				envVars := make([]string, 0, len(cred.Env))
diff --git a/pkg/cli/credential_delete.go b/pkg/cli/credential_delete.go
index 26d24b2a..db1f97b8 100644
--- a/pkg/cli/credential_delete.go
+++ b/pkg/cli/credential_delete.go
@@ -14,7 +14,7 @@ type Delete struct {
 }
 
 func (c *Delete) Customize(cmd *cobra.Command) {
-	cmd.Use = "delete <tool name>"
+	cmd.Use = "delete <credential name>"
 	cmd.Aliases = []string{"rm", "del"}
 	cmd.SilenceUsage = true
 	cmd.Short = "Delete a stored credential"
diff --git a/pkg/cli/credential_show.go b/pkg/cli/credential_show.go
new file mode 100644
index 00000000..92911dde
--- /dev/null
+++ b/pkg/cli/credential_show.go
@@ -0,0 +1,61 @@
+package cli
+
+import (
+	"fmt"
+	"os"
+	"text/tabwriter"
+
+	"github.com/gptscript-ai/gptscript/pkg/cache"
+	"github.com/gptscript-ai/gptscript/pkg/config"
+	"github.com/gptscript-ai/gptscript/pkg/credentials"
+	"github.com/spf13/cobra"
+)
+
+type Show struct {
+	root *GPTScript
+}
+
+func (c *Show) Customize(cmd *cobra.Command) {
+	cmd.Use = "show <credential name>"
+	cmd.Aliases = []string{"reveal"}
+	cmd.SilenceUsage = true
+	cmd.Short = "Show the secret value of a stored credential"
+	cmd.Args = cobra.ExactArgs(1)
+}
+
+func (c *Show) Run(_ *cobra.Command, args []string) error {
+	opts, err := c.root.NewGPTScriptOpts()
+	if err != nil {
+		return err
+	}
+	opts.Cache = cache.Complete(opts.Cache)
+
+	cfg, err := config.ReadCLIConfig(c.root.ConfigFile)
+	if err != nil {
+		return fmt.Errorf("failed to read CLI config: %w", err)
+	}
+
+	store, err := credentials.NewStore(cfg, c.root.CredentialContext, opts.Cache.CacheDir)
+	if err != nil {
+		return fmt.Errorf("failed to get credentials store: %w", err)
+	}
+
+	cred, exists, err := store.Get(args[0])
+	if err != nil {
+		return fmt.Errorf("failed to get credential: %w", err)
+	}
+
+	if !exists {
+		return fmt.Errorf("credential %q not found", args[0])
+	}
+
+	w := tabwriter.NewWriter(os.Stdout, 10, 1, 3, ' ', 0)
+	defer w.Flush()
+
+	_, _ = w.Write([]byte("ENV\tVALUE\n"))
+	for env, val := range cred.Env {
+		_, _ = fmt.Fprintf(w, "%s\t%s\n", env, val)
+	}
+
+	return nil
+}