myapi-vault-cli

One-command access to your self-hosted MyApi credential vault from any machine. Browser login, ASC-signed requests (bypass per-device approval), and simple get/put of secrets — no manual env vars.

Install

npm install -g myapi-vault-cli

Requires Node ≥ 18. For per-user Cloudflare Access SSO, install cloudflared (optional; a shared service token also works).

Login

myapi login

login is 100% browser by default — no secrets, no env vars:

1. Cloudflare Access — opens browser SSO via cloudflared (install once: brew install cloudflared / downloads). Use --cf-token for a shared service token instead.
2. App token — a device-flow code you approve in the dashboard (no paste). Use --paste to supply an existing token instead.
3. ASC key — generates + registers an Ed25519 identity so future requests skip per-device approval (approve it once under Devices).

Config is cached at ~/.config/myapi/config.json (mode 600). Approve the ASC device once in your MyApi dashboard when prompted.

Use

myapi whoami                                  # verify identity
myapi list                                    # list stored entries
myapi put "OpenAI" "sk-..." https://api.openai.com openai
myapi get openai                              # reveal by label/service
myapi reveal <id>                             # reveal by id
myapi del <id>                                # delete
myapi logout                                  # clear local config

Reading a secret in scripts

KEY=$(myapi get openai | node -pe 'JSON.parse(require("fs").readFileSync(0)).token')

Flags

| Flag | Effect | |------|--------| | --cf-token | Use a Cloudflare Access service token instead of cloudflared browser SSO. | | --paste | Paste an existing MyApi token instead of the browser device flow. |

With --cf-token, set the service-token credentials via env (recommended over the prompt):

export MYAPI_CF_CLIENT_ID='<...>.access'
export MYAPI_CF_CLIENT_SECRET='<...>'
myapi login --cf-token

Env

• MYAPI_CONFIG_DIR — override ~/.config/myapi.
• MYAPI_CF_CLIENT_ID / MYAPI_CF_CLIENT_SECRET — Cloudflare Access service token (for --cf-token).

Security

• Your token + ASC key live only in ~/.config/myapi/ (0600). Keep to trusted machines.
• The MyApi vault is full-access per token; each engineer should use their own token (revoke individually).
• No secrets are printed to logs.

License

MIT