@vaultic-dev/cli

Command-line client for Vaultic — encrypted, versioned secrets management with environment inheritance, rotation, and audit logging. This package installs the vaultic binary; it talks to a Vaultic server over the REST API and never handles crypto itself beyond decrypting values already fetched over the wire.

Install

npm install -g @vaultic-dev/cli
vaultic --help

Requires Node.js >= 20. You'll also need a Vaultic server to talk to — either your own self-hosted instance, or one your team runs (see the main repo README for self-hosting instructions).

Quick start

vaultic login                      # opens a browser to approve the login (--no-browser for the
                                    # email/password prompt, --token to paste one)
vaultic init                       # interactive: pick/create workspace -> project -> default env
                                    # writes .vaultic.yaml in the current directory

vaultic secrets set FOO bar        # stored encrypted server-side, versioned
vaultic secrets list               # masked by default
vaultic secrets list --reveal      # explicit reveal, audited separately from list/read

vaultic run -- printenv FOO        # injects secrets as env vars into the subprocess -> "bar"
vaultic export                     # writes .env (dotenv format) with a checksum header
vaultic status                     # compares local .env vs the server
vaultic sync                       # pulls latest values, regenerates .env, runs post_sync hook

By default, vaultic --server <url> (or the VAULTIC_API_URL env var) points at your server; otherwise it defaults to http://localhost:4000.

Command reference

| Group | Commands | |---|---| | Auth | login, logout, whoami | | Project setup | init (writes .vaultic.yaml) | | Secrets | secrets list/get/set/delete/history/rollback/rename/rotate/substitute, secrets override set/clear, rotation-providers | | Local file sync | run, export, import, status, sync | | Environments | env list/create/duplicate/diff/promote/lock/unlock/proposals/approve/reject | | Workspace | workspace invite/invites/revoke-invite/members/set-role/remove-member/accept-invite | | Access grants | access grant/list/revoke | | Service tokens | tokens create/list/revoke | | Sharing | share <key> — one-time/limited-view unauthenticated link | | Webhooks | webhooks create/list/delete/deliveries | | Third-party push | push github, push vercel | | Git integration | git-integration setup/show/remove — ephemeral preview environments |

Run vaultic <command> --help for a command's full options.

Links

• Full documentation, deployment guide, and security model
• Changelog
• Issues