CLI

Install and use the SikkerKey CLI to read, export, inject, cache, and synchronize secrets with a machine identity.

Updated yesterday

The SikkerKey CLI brings machine-authenticated secret access into terminals, scripts, local development, deployment jobs, and long-running workloads. Use it to read individual secrets, explore the resources a machine can access, inject secrets into a process, export configuration, continue with encrypted cached values during an outage, and run managed-secret sync agents.

The CLI follows the access granted to its machine identity. When project membership or a secret grant changes in SikkerKey, subsequent commands use the updated access.

#Install the CLI

The packaged CLI supports Linux on x64 and ARM64, macOS on Intel and Apple Silicon, and Windows on x64.

Install with npm

bash

npm install -g sikkerkey

You can also run it without a global installation:

bash

npx sikkerkey

Install with Go

bash

go install github.com/SikkerKeyOfficial/sikkerkey-cli@latest

Confirm the installation:

bash

sikkerkey version

The CLI is open source under the MIT license. The source is available from SikkerKeyOfficial/sikkerkey-cli.

#Before you begin

Provision and approve a standard machine in your SikkerKey vault, then complete its bootstrap instructions on the computer that will run the CLI. Bootstrapping installs the machine identity and private key used to authenticate requests.

When one bootstrapped vault is present, the CLI can select it automatically. When several vault identities are present, choose the one you want to use:

bash

sikkerkey connect vault_...
sikkerkey connect vault_... --alias production

A vault alias is local to the computer and can be used anywhere the CLI accepts a vault reference.

bash

sikkerkey connect production

Inspect or change the current selection:

bash

sikkerkey connect
sikkerkey connect --list
sikkerkey connect --clear

For automation, set SIKKERKEY_VAULT to a vault ID or local alias. This selection takes precedence over the saved default.

bash

SIKKERKEY_VAULT=vault_... sikkerkey status

#Quick start

Check the selected identity and connection.
bash
```
sikkerkey whoami
sikkerkey status
```
See the applications, projects, and secrets available to the machine.
bash
```
sikkerkey list applications
sikkerkey list projects
sikkerkey list secrets
```
Read a secret.
bash
```
sikkerkey get sk_...
```
Run an application with secrets supplied as environment variables.
bash
```
sikkerkey run --all --project proj_... -- ./your-application
```

Use --dry-run before launching a process to review the environment-variable names. Values remain masked unless you deliberately add --show-values.

#Explore accessible resources

List commands show the resources available to the selected machine identity:

bash

sikkerkey list vaults
sikkerkey list applications
sikkerkey list projects
sikkerkey list secrets

vaults shows identities bootstrapped on this computer. The selected vault is marked with an asterisk.
applications shows accessible applications and the number of projects in each application.
projects groups accessible projects by application, with standalone projects shown separately.
secrets groups accessible secrets by application and project and identifies structured secrets.

#Scope work to an application or project

Set an application scope when you want application-focused listings and bulk operations:

bash

sikkerkey set application app_...
sikkerkey set application

The selected application is saved locally for the current vault. It scopes list secrets, list projects, export, and run --all to that application.

Use an explicit project when a command should target one project. A project ID or project name can be used, and the project selection takes precedence over the saved application scope:

bash

sikkerkey export --project proj_... --format json
sikkerkey run --all --project proj_... -- ./your-application

Return to all accessible projects:

bash

sikkerkey set application none

#Read standard and structured secrets

Read a secret value by ID:

bash

sikkerkey get sk_...

For a structured secret, provide a field name to return only that field:

bash

sikkerkey get sk_... password

Use JSON output when a script needs the secret ID, value, and parsed structured fields in a predictable object:

bash

sikkerkey get sk_... --output json

get writes the requested value to standard output. Treat terminal output, captured logs, command substitutions, and redirected files as secret-bearing data.

#Export secrets

Export all secrets available in the current scope, or select a project. Structured secrets expand into one entry per field.

bash

sikkerkey export
sikkerkey export --format json
sikkerkey export --project proj_... --format yaml
sikkerkey export --project proj_... --format dotenv > .env

Available formats are env, json, yaml, and dotenv. Environment names are generated from the secret name in uppercase, with spaces and punctuation converted to underscores. A structured secret named “Database Credentials” with a field named “password” becomes DATABASE_CREDENTIALS_PASSWORD.

Exports contain plaintext secret values. Restrict access to generated files, keep them out of source control, and remove them when they are no longer needed.

#Run a process with secrets

sikkerkey run fetches secrets, adds them to the child process environment, and starts the command after --. The child also inherits the environment already present in the shell.

Inject selected secrets

bash

sikkerkey run --secret sk_... --secret sk_... -- node server.js

Explicitly selected secrets use their IDs to create collision-resistant variable names. A structured field is appended to the ID-derived name.

Inject all secrets in a scope

bash

sikkerkey run --all --project proj_... -- node server.js

With --all, names are based on the secret names. Add a prefix when the application expects a shared namespace:

bash

sikkerkey run --all --project proj_... --prefix MYAPP_ -- ./your-application

Preview the environment

bash

sikkerkey run --all --project proj_... --dry-run

The preview shows variable names with masked values. Add --show-values only when you need to inspect the real values in a controlled terminal.

Restart after a secret changes

bash

sikkerkey run --watch --all --project proj_... -- node server.js

Watch mode checks the selected secrets for changes every 15 seconds. When a change is detected, the CLI stops the child process, fetches the current values, and starts it again. Interrupt and termination signals are forwarded to the child process.

#Use the encrypted fallback cache

The optional fallback cache keeps previously read secrets available during a temporary connection failure. It is disabled by default.

bash

sikkerkey cache enable

While enabled, successful reads are stored as separate encrypted cache entries for the selected vault. Each entry is protected with AES-256-GCM using a key derived from that machine’s private identity and vault. An entry is bound to its vault, machine, secret ID, and cache time, so copying or swapping cache files does not make them usable elsewhere.

During a network failure or gateway outage, the CLI can automatically serve a cached value and reports the cache age to standard error. Access denials, revoked access, deleted secrets, authentication failures, rate limits, and other authoritative responses are returned as errors.

Read deliberately from the cache

bash

sikkerkey get sk_... --offline
sikkerkey run --all --offline -- ./your-application
sikkerkey export --offline

A secret must have been fetched successfully while caching was enabled before it can be used offline. Offline bulk operations use all usable entries cached for the selected vault; application and project filters require a live connection and are not applied.

--offline cannot be combined with --watch.

Inspect, disable, or clear the cache

bash

sikkerkey cache status
sikkerkey cache disable
sikkerkey cache clear

Disabling stops new cache writes and automatic fallback. Existing encrypted entries remain available until they are cleared. Clearing removes cached secrets for the selected vault.

#Synchronize managed-secret rotations

The CLI includes a sync agent for managed database and cache credentials. The agent watches a managed secret, applies a pending credential change to the connected service, verifies that the new credentials work, and then confirms the rotation with SikkerKey. If applying or verifying the credentials fails, the agent reports the failure and attempts to restore the previous credentials when possible.

Supported providers in the CLI are PostgreSQL, PostgreSQL for Supabase, MySQL, MongoDB, and Redis.

Run an agent

bash

sikkerkey agent start --secret sk_...

When the managed secret already has its synchronization connection configured in SikkerKey, the agent retrieves that configuration and starts in the foreground.

Install an agent as a service

bash

sikkerkey agent install --secret sk_...
sikkerkey agent install --secret sk_... --now

Without --now, the command prints the service configuration and installation instructions. With --now, it installs and starts the service using systemd on Linux, launchd on macOS, or the available Windows service mechanism.

Manage running agents

bash

sikkerkey agent list
sikkerkey agent stop --secret sk_...

For a locally configured agent, use agent test to verify its connection and agent remove to remove its local configuration.

Run the sync agent under a dedicated operating-system account with only the permissions and network access required for its managed service.

#Check identity and connectivity

Display the current machine ID, machine name, vault, application scope, API address, and private-key location:

bash

sikkerkey whoami

Verify that the private key is readable, authenticate to SikkerKey, and count accessible secrets:

bash

sikkerkey status

status exits with code 0 when the checks succeed and code 1 when a check fails, making it suitable for setup validation and health checks.

#Manage local vault identities

Rename a vault’s local alias:

bash

sikkerkey rename vault vault_... team-production

Remove a bootstrapped vault identity, its private key, and its cached data from the current computer:

bash

sikkerkey delete vault vault_...

After removing a local identity, revoke or delete the corresponding machine in the SikkerKey dashboard to end its server-side access record.

#Add shell completion

Generate completion for Bash, Zsh, or Fish:

bash

eval "$(sikkerkey completion bash)"
eval "$(sikkerkey completion zsh)"
sikkerkey completion fish > ~/.config/fish/completions/sikkerkey.fish

Add the command appropriate for your shell to its profile to make completion available in future sessions.

#Command reference

Command	Purpose
connect	Select, list, alias, or clear the local vault selection
set application	Set, show, or clear an application scope
list	List vaults, applications, projects, or secrets
get	Read a secret or one structured-secret field
export	Write secrets as env, JSON, YAML, or dotenv
run	Inject secrets into a child process
cache	Enable, inspect, disable, or clear encrypted fallback entries
agent	Run and manage managed-secret sync agents
whoami	Show the selected machine identity and scope
status	Check the key, authentication, and accessible-secret count
rename vault	Change a local vault alias
delete vault	Remove a vault identity from this computer
completion	Generate Bash, Zsh, or Fish completion
version	Print the installed CLI version

Use sikkerkey <command> --help for the options and examples available to any command.