apivault CLI

Requirements

• Node.js 18.17.0 or newer

Installation

npm install -g apivault

Or run on-demand without a global install:

npx apivault <command>

Quick start

The most common workflow is using apivault run to securely inject secrets into your local development server without ever writing them to disk.

# 1. Authorize your terminal
apivault login

# 2. Set your default environment (optional)
apivault config set run.env Development

# 3. Inject secrets and start your app
apivault run -- npm run dev

Global options

Available on every command:

Running apivault with no arguments prints sign-in status and exits.

Authentication

Sign-in happens in your browser, not the terminal. CLI tokens are separate from MCP OAuth tokens — revoking one does not affect the other.

login

Opens a browser to approve the CLI's connection to your account.

apivault login

whoami

Show the currently signed-in user.

apivault whoami

logout

Revoke this device's token and sign out.

apivault logout

The CLI manages the following local data files:

keys — Manage stored API keys

keys list

Lists all vault keys for the connected account. Key values are masked by default.

apivault keys list

keys add

Interactive by default. Fully non-interactive for scripting:

apivault keys add \
  --name STRIPE_SECRET \
  --service Stripe \
  --environment Production \
  --key "sk_live_..." \
  --notes "Billing API"

Interactive defaults: service = Custom, environment = Production.

keys get

# View key details (value is masked)
apivault keys get <id>

# Decrypt and show the raw value
apivault keys get <id> --reveal

keys update

Interactive wizard to edit a key's name, service, environment, notes, or value.

apivault keys update <id>

keys delete

Deletes a key. You will be prompted to confirm before deletion.

# Interactive deletion
apivault keys delete <id>

# Force delete without prompt
apivault keys delete <id> -f

Custom vault passphrase

If you set a custom encryption key on the website (Settings → Encryption Key), operations that encrypt or decrypt need that passphrase. Resolution order:

1. --vault-key flag
2. APIVAULT_KEY environment variable
3. Config value vaultKey
4. Interactive hidden prompt

# 1. Pass explicitly via flag
apivault keys get <id> --reveal --vault-key "your passphrase"

# 2. Use an environment variable
APIVAULT_KEY="your passphrase" apivault keys get <id> --reveal

# 3. Store locally in config (prompts securely)
apivault config set vaultKey

run — Inject secrets and run a command

# Run with the Production environment
apivault run --env Production -- npm start

# Run with Staging
apivault run --env Staging -- node server.js

Loads all keys for an environment, decrypts them, and injects each key's name as an environment variable into the child process. Local dotenv files (.env, .env.local, etc.) are temporarily renamed to *.apivault-run-hidden while the command runs, then restored on exit. Nothing is written to disk.

Resolution precedence

apivault config set run.env Production
apivault config set run.command "npm start"
apivault run                          # uses both defaults

env — Export and restore dotenv files

env export

Decrypt keys for an environment and write them to a local .env file:

# Export to .env (merges with existing variables)
apivault env export --env Production

# Export to a custom file
apivault env export --env Staging -o .env.local

# Replace the file entirely instead of merging
apivault env export --env Production --force

By default, existing variables in the target file are preserved — vault keys are updated in place and new keys appended. Always add .env to .gitignore.

env restore

Restore hidden dotenv backups created by apivault run:

# Restore in the current directory
apivault env restore

# Restore in a specific directory
apivault env restore -C /path/to/project

config — Local CLI defaults

The CLI supports three configuration keys. Explicit command flags always override these defaults:

config list

Show all config values. Secrets like vaultKey are masked.

apivault config list

config get

Print a specific config value (e.g. run.command).

apivault config get run.command

config set

Set a config value. vaultKey is stored in plaintext in config.json — skip storing it if you prefer --vault-key, APIVAULT_KEY, or the interactive prompt. If you omit the value for a secret key, you will be prompted securely.

# Set default environment
apivault config set run.env Production

# Set default command
apivault config set run.command "npm start"

# Prompt securely for the passphrase
apivault config set vaultKey

config delete

Remove a config value.

apivault config delete run.env

Scripting with --json

Pass the --json flag to any command to emit machine-readable JSON output to stdout instead of styled text. This makes it easy to integrate the CLI into automated scripts, CI/CD pipelines, and tools like jq.

When --json is enabled, standard success messages and UI formatting are disabled. Errors are also emitted to stdout as a JSON object containing an error key (e.g. {"error": "message"}) so your script can reliably parse the output.

# Extract just the IDs of all keys
apivault --json keys list | jq '.[] | .id'

# Decrypt a specific key and output raw text
apivault --json keys get <id> --reveal | jq -r .rawKey

# Export an environment programmatically
apivault --json env export --env Production

Security

Troubleshooting