SikkerKey CLI

The official command-line interface for SikkerKey — secrets management with Ed25519 machine authentication.

Installation

npm install -g sikkerkey

Or run without installing:

npx sikkerkey

Quick Start

1. Connect to your vault

sikkerkey connect <vault-id>

Selects which bootstrapped vault identity to use. If only one vault is registered on this machine, it auto-selects.

2. Read a secret

sikkerkey get <secret-id>

# Read a specific field from a structured secret
sikkerkey get <secret-id> password

# JSON output for scripting
sikkerkey get <secret-id> -o json

Project access is determined by grants on the dashboard. There is no client-side unlock step — the CLI fetches accessible secrets live from the server.

3. List what you have access to

sikkerkey list secrets       # all granted secrets, grouped by project
sikkerkey list projects      # all projects this machine is in
sikkerkey list vaults        # bootstrapped vaults on this laptop

4. Export secrets

sikkerkey export
sikkerkey export --format json
sikkerkey export --project production --format dotenv > .env

Exports all secrets the machine has access to. Supports env, json, yaml, and dotenv formats. --project accepts either a project name or id.

5. Inject secrets into a process

# Inject specific secrets
sikkerkey run --secret <id> --secret <id> -- node app.js

# Inject all secrets from a project
sikkerkey run --all --project production -- node app.js

# Auto-restart on secret changes
sikkerkey run --watch --all --project production -- node app.js

You must specify which secrets to inject with --secret or --all. The --watch flag polls for changes and restarts the process automatically when secrets are rotated.

Commands

Setup

| Command | Description | |---------|-------------| | connect <vault-id> | Select a vault identity |

Config

| Command | Description | |---------|-------------| | rename vault <old> <new> | Rename the local alias for a vault | | delete vault <name> | Remove a bootstrapped vault from this machine |

Secrets

| Command | Description | |---------|-------------| | get <id> [field] [-o json] | Read a secret value or field |

Operations

| Command | Description | |---------|-------------| | list secrets\|vaults\|projects | List resources | | export [--project <name>] [--format env\|json\|yaml\|dotenv] | Export secrets in various formats | | run --secret <id>\|--all [--project <name>] [--watch] -- <cmd> | Inject secrets as env vars and run a command |

Sync Agent

| Command | Description | |---------|-------------| | agent start --secret <id> | Run a sync agent in the foreground | | agent configure --secret <id> ... | Configure database connection for a secret | | agent install --secret <id> | Install as a system service | | agent list | Show running agents | | agent stop --secret <id> | Stop an agent | | agent remove --secret <id> | Remove agent config | | agent test --secret <id> | Test database connection |

Info

| Command | Description | |---------|-------------| | whoami | Print machine identity | | status | Check connectivity and authentication | | completion bash\|zsh\|fish | Generate shell completions | | version | Print version |

Machine Authentication

SikkerKey uses Ed25519 signatures for machine authentication — no API keys, no tokens, no sessions. Every request is signed with the machine's private key, which never leaves the machine.

After bootstrapping, the machine must be approved in the SikkerKey dashboard before it can access any secrets. Project membership and per-secret grants are also managed in the dashboard; the CLI reflects those grants live and does not cache project state locally.

Supported Platforms

| OS | Architecture | |----|-------------| | Linux | x64, arm64 | | macOS | x64, arm64 (Apple Silicon) | | Windows | x64 |

Documentation

Full documentation: docs.sikkerkey.com

• CLI Overview
• Setup Commands
• Secret Commands
• Operations
• Sync Agent Commands

License

Proprietary. See sikkerkey.com/terms for details.