COMMAND LINE

The vault CLI

Fetch, set, rotate, and run with your secrets — never touching disk. Resolve a single value to stdout, inject the whole scope into your dev server, or rotate a key everywhere it's used, all from the terminal.

Install & quickstart

Install once, authenticate with a service token, then read a secret or run your app with every secret injected — no .env file required.

TERMINAL

# 1. install (once) — private, via GitHub Packages
#    add to ~/.npmrc (needs a GitHub token with read:packages):
#    @dialed-technologies:registry=https://npm.pkg.github.com
#    //npm.pkg.github.com/:_authToken=YOUR_GITHUB_PAT
npm i -g @dialed-technologies/vault

# 2. point at your vault + authenticate (hidden prompt for the token)
vault init
vault login --project client-portal --env development

# 3. read a single secret...
vault get STRIPE_KEY --project client-portal --env development

# 4. ...or run your app with every secret injected — no .env file, ever
vault run --project client-portal --environment development -- npm run dev

Command reference

Every command, grouped by what it's for. All secret-scoped commands accept --project, --env, and an optional --branch override.

SETUP

Setup

Point the CLI at your vault and authenticate once.

vault init

vault init [--token <dvst_…>] [--api-url <url>]

Initialize configuration at ~/.dialed-vault/config.json. Prompts for a service token (hidden input) unless one is passed; won't clobber an existing config's other fields.

--token <token>Service token to store (dvst_<org>.<secret>). Prefer the hidden prompt — a flag leaks into ps and shell history.

--api-url <url>Base URL of the vault API (default http://localhost:3000).

vault login

vault login [--token <dvst_…>] [--org <id>] [--project <slug>] [--env <slug>]

Authenticate with a service token and optionally store default org / project / environment for reference. Prompts securely (hidden) if --token is omitted.

--token <token>Service token (dvst_<org>.<secret>); if omitted, you'll be prompted.

--org <org>Default organization id (optional, for reference).

--project <project>Default project slug (optional).

--env <env>Default environment slug (optional).

--api-url <url>Base URL of the vault API.

SECRETS

Secrets

Read, write, rotate, and run with secrets. Values pipe cleanly and never hit disk unless you export.

vault run

vault run [--project <slug>] [--environment <slug>] [--branch <name>] [--overload] -- <command…>

Fetch every secret for the scope and inject them as environment variables into the child process, then run your command. Nothing is written to disk. By default vault values do not override existing env vars; the process exits with the child's exit code.

--project <slug>Project to resolve secrets for.

--environment <slug>Environment to resolve (development, staging, production).

--branch <name>Branch override (optional).

--overloadLet vault values win over existing environment variables (off by default).

-- <command…>Everything after -- is the command to run with the injected secrets.

vault get

vault get <key> --project <p> --env <e> [--branch <b>]

Resolve and print a single secret to stdout — raw value only, so it pipes cleanly. Never written to disk.

--project Project ID (required).

--env <e>Environment: development, staging, production (required).

--branch Branch override (optional).

vault set

vault set <key> --project <p> --env <e> [--value <val>] [--branch <b>]

Create or update a secret, writing a new version. Pass the value via --value or, recommended, via the hidden stdin prompt to keep it out of shell history.

--project Project ID (required).

--env <e>Environment (required).

--value <val>Secret value. If omitted, reads from a hidden prompt / stdin.

--branch Branch override (optional).

vault rotate

vault rotate <key…> --project <p> --env <e> [--value <val>] [--branch <b>]

Rotate one or more secrets — each gets a fresh version. Prompts (hidden) for every key's new value unless --value is given (only valid for a single key).

--project Project ID (required).

--env <e>Environment (required).

--value <val>New value — only valid when rotating exactly one key.

--branch Branch override (optional).

vault export

vault export --project <p> --env <e> [--output <path>] [--stdout] [--force] [--branch <b>]

Export resolved secrets as a .env file for local development. Refuses to write unless the target is gitignored, and stamps the file with a generated-by header.

--project Project ID (required).

--env <e>Environment (required).

--output <path>Output file path (default: .env.local).

--stdoutWrite to stdout instead of a file.

--forceWrite even if the target isn't gitignored (warns instead of refusing).

--branch Branch override (optional).

vault import

vault import <file> --project <p> --env <e> [--branch <b>]

Bulk-load a .env file into the vault. Handles comments, blanks, quoted and multi-line values; warns on malformed lines and duplicate keys (last occurrence wins).

--project Project ID (required).

--env <e>Environment (required).

--branch Branch override (optional).

OPS

Ops

Audit access and stay ahead of expiring or rotation-due secrets.

vault audit

vault audit [--project <p>] [--key <k>] [--limit <n>]

View access history for secrets. Shows the actor, action, and resolved key alongside the raw project / environment ids.

--project Filter by project ID (optional).

--key <k>Filter by secret key (optional).

--limit <n>Number of entries to display (default: 50).

vault expiring

vault expiring [--within-days <n>] [--project <p>] [--json]

List secrets that are expired, expiring soon, or overdue for rotation — metadata only, never values. Cron-friendly: exit 0 = all clear, 1 = attention needed, 2 = the check itself failed.

--within-days <n>Look-ahead window in days, 1–365 (default: 14).

--project Filter by project slug (optional).

--jsonPrint the raw JSON response (for scripts / cron).

SAFETY

Safety

Keep plaintext secrets out of git for good.

vault precommit

vault precommit [--install]

Install a git pre-commit hook that blocks committing plaintext dotenv files (.env, .env.*) — except .env.example / .sample / .template. Run `vault precommit` on its own to perform the check.

--installInstall the pre-commit hook into the current repository.