@toknbase/cli

The official CLI for Toknbase -- zero-knowledge secrets management for developers and CI/CD pipelines.

Read, create, and export secrets from any terminal or pipeline script using a scoped agent token.

Quick Start

1. Install

npm install -g @toknbase/cli

Or run without installing:

npx @toknbase/[email protected] list

2. Set your agent token

Create an agent token in your Toknbase dashboard under AI Agents, then export it:

export TOKNBASE_AGENT_TOKEN=agt_your_token_here

For persistent local use, add this to your shell profile (~/.zshrc or ~/.bashrc).

3. Use it

toknbase list
toknbase get STRIPE_SECRET_KEY
toknbase export > .env
toknbase set MY_API_KEY new_value

Commands

| Command | Description | Scope Required | |---|---|---| | toknbase get NAME | Print the value of a secret | read_only | | toknbase list | List all secret names and environments (no values) | read_only | | toknbase set NAME VALUE | Create or update a secret | read_write | | toknbase export | Print all secrets in .env format | read_only |

CI/CD Usage

GitHub Actions

- name: Load secrets from Toknbase
  env:
    TOKNBASE_AGENT_TOKEN: ${{ secrets.TOKNBASE_AGENT_TOKEN }}
  run: |
    npx @toknbase/[email protected] export > .env
    source .env

Or inject a single secret as a step output:

- name: Get Stripe key
  id: secrets
  env:
    TOKNBASE_AGENT_TOKEN: ${{ secrets.TOKNBASE_AGENT_TOKEN }}
  run: echo "STRIPE_KEY=$(npx @toknbase/[email protected] get STRIPE_SECRET_KEY)" >> $GITHUB_OUTPUT

GitLab CI

deploy:
  script:
    - npx @toknbase/[email protected] export > .env
    - source .env
  variables:
    TOKNBASE_AGENT_TOKEN: $TOKNBASE_AGENT_TOKEN

CircleCI

- run:
    name: Load secrets
    command: |
      npx @toknbase/[email protected] export > .env
      source .env

Shell Substitution

toknbase get prints only the value with a newline, making it safe for shell substitution:

export STRIPE_KEY=$(toknbase get STRIPE_SECRET_KEY)
curl -H "Authorization: Bearer $STRIPE_KEY" https://api.stripe.com/v1/charges

Environment Variables

| Variable | Required | Description | |---|---|---| | TOKNBASE_AGENT_TOKEN | Yes | Your agt_ agent token from the dashboard | | TOKNBASE_CANISTER_ID | No | Override canister ID (default: xi7mc-uaaaa-aaaan-q5raa-cai) | | TOKNBASE_IC_HOST | No | Override IC host (default: https://icp-api.io) |

Requirements

• Node.js 18+
• A Toknbase account with an active agent token (sign up free)

Docs

Full documentation: toknbase.net/docs/cli