# Full Reference All CLI commands on a single page. Source: https://keyenv.dev/docs/cli/reference/ Quick reference for all KeyEnv CLI commands. ## Authentication | Command | Description | |---------|-------------| | keyenv login | Authenticate with KeyEnv | | keyenv logout | Clear stored credentials | | keyenv whoami | Display current user | ## Projects | Command | Description | |---------|-------------| | keyenv init | Initialize project in current directory | | keyenv projects | List all projects | | keyenv switch <project> | Switch to a different project | ## Secrets | Command | Description | |---------|-------------| | keyenv pull | Pull secrets to .env file | | keyenv push | Push .env secrets to server | | keyenv list | List secret keys | | keyenv get <key> | Get a secret value | | keyenv set <key> <value> | Set a secret | | keyenv delete <key> | Delete a secret | | keyenv export | Export secrets to various formats | ## Export Export secrets to various formats (dotenv, JSON). | Command | Description | |---------|-------------| | keyenv export | Export secrets to stdout | | keyenv export -e <env> | Export from specific environment | | keyenv export -f <format> | Export in format (dotenv, json) | | keyenv export -o <file> | Export to file | ### Options | Option | Description | |--------|-------------| | -e, --env <ENV> | Environment to export from (default: development) | | -f, --format <FORMAT> | Output format: dotenv, json (default: dotenv) | | -o, --output <FILE> | Write output to file instead of stdout | ### Examples ```bash # Export as dotenv to stdout keyenv export # Export production secrets as JSON keyenv export -e production -f json # Export to a file keyenv export -o .env.local ``` ## Workflow | Command | Description | |---------|-------------| | keyenv run -- <cmd> | Run command with secrets | | keyenv diff | Compare local and remote | | keyenv history <key> | View secret history | ## Permissions | Command | Description | |---------|-------------| | keyenv permissions list | List permissions for an environment | | keyenv permissions set <email> <role> | Set a user's permission (none/read/write/admin) | | keyenv permissions delete <email> | Remove a user's permission | | keyenv permissions my | Show your permissions for all environments | ## Tokens Manage service tokens for CI/CD and programmatic access. | Command | Description | |---------|-------------| | keyenv tokens list | List all service tokens | | keyenv tokens create --name <name> --scope <scope> | Create a new service token | | keyenv tokens revoke <id> | Revoke a service token | | keyenv tokens rotate <id> | Rotate a service token | ### Options | Option | Commands | Description | |--------|----------|-------------| | -n, --name <NAME> | create | Token name | | -s, --scope <SCOPE> | create | Token scope: read, write, admin (repeatable) | | -p, --project <ID> | create | Project ID (defaults to current project) | | -e, --env <ID> | create | Restrict to a specific environment ID | | --expires <DAYS> | create | Token expiry in days (omit for never) | | -y, --yes | revoke | Skip confirmation prompt | | --grace-period <MINS> | rotate | Grace period in minutes for old token (default: 5, max: 60) | ### Examples ```bash # List all tokens keyenv tokens list # Create a read-only token for CI keyenv tokens create --name deploy-ci --scope read # Create an admin token that expires in 90 days keyenv tokens create --name admin-token --scope admin --expires 90 # Revoke a token keyenv tokens revoke st_abc123 # Revoke without confirmation keyenv tokens revoke st_abc123 --yes # Rotate a token with 30-minute grace period keyenv tokens rotate st_abc123 --grace-period 30 ``` ## Teams Manage teams and team members. | Command | Description | |---------|-------------| | keyenv team list | List your teams | | keyenv team create <name> | Create a new team | | keyenv team show <id> | Show team details and members | | keyenv team use <id> | Set default team for current session | | keyenv team invite <email> [role] [--team <team_id>] | Invite a member (default: member) | | keyenv team role <team> <user> <role> | Update a member's role | | keyenv team remove <team> <user> | Remove a member from a team | | keyenv team invitations <team> | List pending invitations | | keyenv team revoke-invite <team> <invitation> | Revoke a pending invitation | | keyenv team resend-invite <team> <invitation> | Resend an invitation email | | keyenv team delete <team> | Delete a team | | keyenv team audit <team> | View team audit log | ### Options | Option | Commands | Description | |--------|----------|-------------| | role | invite | Role for invited user: admin or member (default: member) | | -y, --yes | remove, revoke-invite, delete | Skip confirmation prompt | ### Examples ```bash # List all teams keyenv team list # Create a new team keyenv team create "My Team" # Show team details keyenv team show team_abc123 # Set default team for the session keyenv team use team_abc123 # Invite a member keyenv team invite user@example.com member --team team_abc123 # Invite as admin keyenv team invite user@example.com admin --team team_abc123 # Change a member's role keyenv team role team_abc123 user_xyz admin # Remove a member keyenv team remove team_abc123 user_xyz # List pending invitations keyenv team invitations team_abc123 # Revoke a pending invitation keyenv team revoke-invite team_abc123 inv_xyz # Resend an invitation email keyenv team resend-invite team_abc123 inv_xyz # Delete a team (requires confirmation) keyenv team delete team_abc123 # View audit log keyenv team audit team_abc123 ``` ## Security | Command | Description | |---------|-------------| | keyenv scan | Scan directory for hardcoded secrets | | keyenv scan <path> | Scan specific path | | keyenv scan --severity <level> | Filter by severity (critical, high, medium, low) | | keyenv scan --json | Output findings as JSON | | keyenv scan --upload | Upload scan results to KeyEnv for tracking | | keyenv scan --hook | Install pre-commit hook | | keyenv scan --hook --remove | Remove pre-commit hook | ## Update Check for and install CLI updates. | Command | Description | |---------|-------------| | keyenv update check | Check if a new version is available | | keyenv update install | Download and install the latest version | ### Examples ```bash # Check for updates keyenv update check # Current version: 0.5.0 # Latest version: 0.6.0 # Run 'keyenv update install' to update # Install the latest version keyenv update install ``` ## Rotations Manage automatic secret rotation configurations. | Command | Description | |---------|-------------| | keyenv rotations list | List all rotation configurations | | keyenv rotations show <id> | Show details of a rotation | | keyenv rotations trigger <id> | Manually trigger a rotation | | keyenv rotations history <id> | View rotation execution history | ### Options | Option | Description | |--------|-------------| | -e, --env <ENV> | Environment (default: development) | ### Examples ```bash # List all rotations keyenv rotations list # Show rotation details keyenv rotations show rot_abc123 # Manually trigger a rotation keyenv rotations trigger rot_abc123 # View rotation history keyenv rotations history rot_abc123 ``` ## Shell Completions | Command | Description | |---------|-------------| | keyenv completions <shell> | Generate shell completion script | Supported shells: `bash`, `zsh`, `fish`, `powershell`, `elvish` ### Setup **Bash** (add to `~/.bashrc`): ```bash source <(keyenv completions bash) ``` **Zsh** (add to `~/.zshrc`): ```bash # Option 1: Direct source source <(keyenv completions zsh) # Option 2: Save to fpath (faster startup) keyenv completions zsh > ~/.zfunc/_keyenv # Then ensure ~/.zfunc is in fpath and run: autoload -Uz compinit && compinit ``` **Fish** (run once): ```bash keyenv completions fish > ~/.config/fish/completions/keyenv.fish ``` **PowerShell** (add to profile): ```powershell keyenv completions powershell | Out-String | Invoke-Expression ``` ## Global Options | Option | Description | |--------|-------------| | --json | JSON output | | -q, --quiet | Minimal output | | --no-color | Disable colored output | | -v, --verbose | Enable verbose output | | -h, --help | Show help | | -V, --version | Show version | ## Common Flags | Flag | Commands | Description | |------|----------|-------------| | -e, --env | Most | Target environment | | -f, --force | pull, push | Overwrite without asking | ## Environment Variables | Variable | Description | |----------|-------------| | KEYENV_TOKEN | Service token for authentication | | KEYENV_API_URL | Custom API server URL | ## Exit Codes | Code | Meaning | |------|---------| | 0 | Success | | 1 | General error | | 2 | Authentication error | | 3 | Not found |