Command line

The sphragis command reads and manages secrets from a terminal, a script or a CI job.

Install

[CLI INSTALL INSTRUCTIONS]

Sign in

sphragis login

The CLI shows a code and opens app.sphragis.siliconblast.com/device in your browser. Check that the code matches, approve it, then type your master password in the terminal. The first time on a computer, the CLI also asks for your Secret Key. Add --no-browser to print the link without opening a browser.

The CLI keeps its sign-in in the operating system keyring. sphragis whoami shows who the CLI acts as. sphragis logout forgets the sign-in, the Secret Key, the device key and the local vault copy on this computer.

Secret references

A reference names one secret: sphragis://PROJECT/ENVIRONMENT/NAME. Add #VERSION to read a version number or alias.

sphragis read sphragis://payments-api/prod/DATABASE_URL

Run a program with secrets

sphragis run starts a command with every secret of one environment set as an environment variable.

sphragis run --project payments-api --env prod -- npm start

Fill a template

sphragis inject replaces each {{ sphragis://… }} placeholder in a template with the secret's value. It reads the template from -i FILE or from standard input. It writes to -o FILE with mode 600, or to standard output.

sphragis inject -i config.tmpl -o config.yaml

Export an environment

sphragis export --project payments-api --env prod --format dotenv -o .env

--format takes dotenv, json or yaml. The output file is written with mode 600.

Manage secrets

Command	What it does
`sphragis secrets ls --project P --env E`	Lists the secrets in an environment.
`sphragis secrets get PATH --project P --env E`	Prints one secret. `--version N` reads a version number or alias.
`sphragis secrets set PATH --project P --env E`	Creates the secret or adds a version. It prompts for the value, or reads it from standard input with `-`. `--ttl 30d` makes the new version expire.
`sphragis secrets rm PATH --project P --env E`	Deletes a secret. You can recover it for 30 days.
`sphragis projects create SLUG`	Creates a project. It is Zero-knowledge unless you add `--managed`.
`sphragis envs create --project P SLUG`	Creates an environment.
`sphragis identities create NAME --project P --env E`	Creates a machine identity that can read one environment and prints its token once. See Secrets in CI.
`sphragis audit verify`	Recomputes the audit log's hash chain and checks its signed checkpoints. It exits with status 1 when the check fails.

Zero-knowledge and Managed projects

A Zero-knowledge project keeps its key in your vault, so only people and machine identities you grant can read its values. A Managed project keeps its key in Sphragis. That lets workloads sign in with their platform's OIDC token, and it means Sphragis can read the values.

Options and environment variables

Variable	Use
`SPHRAGIS_TOKEN`	A machine identity token. Commands that read secrets use it in place of your sign-in.
`SPHRAGIS_ACCOUNT` or `--account`	Act in a Family or Team account in place of your Individual account.
`SPHRAGIS_CONFIG_DIR`	Where the CLI keeps its settings.
`SPHRAGIS_CREDENTIALS=file`	Keeps credentials in a mode 600 file in place of the OS keyring, for servers with no keyring.
`SPHRAGIS_API_URL`, `SPHRAGIS_SECRETS_URL`, `SPHRAGIS_ISSUER`	Point the CLI at another environment. The defaults are production.