diff --git a/cli/packages/cmd/secrets.go b/cli/packages/cmd/secrets.go
index 29f4ea4554..8175edd76b 100644
--- a/cli/packages/cmd/secrets.go
+++ b/cli/packages/cmd/secrets.go
@@ -478,6 +478,17 @@ func getSecretsByNames(cmd *cobra.Command, args []string) {
 		util.HandleError(err, "To fetch all secrets")
 	}
 
+	if shouldExpand {
+		authParams := models.ExpandSecretsAuthentication{}
+		if token != nil && token.Type == "service-token" {
+			authParams.InfisicalToken = token.Token
+		} else if token != nil && token.Type == "universal-auth-token" {
+			authParams.UniversalAuthAccessToken = token.Token
+		}
+
+		secrets = util.ExpandSecrets(secrets, authParams, "")
+	}
+
 	requestedSecrets := []models.SingleEnvironmentVariable{}
 
 	secretsMap := getSecretsByKeys(secrets)
@@ -494,18 +505,6 @@ func getSecretsByNames(cmd *cobra.Command, args []string) {
 		}
 	}
 
-	if shouldExpand {
-
-		authParams := models.ExpandSecretsAuthentication{}
-		if token != nil && token.Type == "service-token" {
-			authParams.InfisicalToken = token.Token
-		} else if token != nil && token.Type == "universal-auth-token" {
-			authParams.UniversalAuthAccessToken = token.Token
-		}
-
-		requestedSecrets = util.ExpandSecrets(requestedSecrets, authParams, "")
-	}
-
 	if showOnlyValue && len(requestedSecrets) > 1 {
 		util.PrintErrorMessageAndExit("--raw-value only works with one secret.")
 	}