Skip to main content

arc vault

arc vault is encrypted secret storage: init a vault, then get/set/list/delete secrets organized by group and name.

arc vault is encrypted secret storage. Secrets are organized as group/name, for example aws/access-key-id.

bash
arc vault <subcommand> [options]

Global flags (see Overview): --json, --view, --instance / -i (which local ARC instance; omit for default), and --home (instance root; to pick which instance, use --instance).

arc vault init

Initialize a new encrypted vault.

Usage

bash
arc vault init [options]
  • --vault-path <path>: path for the vault file (default ~/.afs-config/vault/vault.enc). --path still works as a deprecated alias for --vault-path, but only on this one subcommand — arc vault get/set/list/delete all accept --vault-path too, but none of them ever accepted --path as an alias for it

Example

bash
$ arc vault init --vault-path ./demo-vault.enc
Vault initialized at ./demo-vault.enc
Reused the existing master key (AFS_VAULT_KEY or OS keychain) — keep that source available.

The master key itself comes from AFS_VAULT_KEY or your OS keychain, not from this command, arc vault init just points a vault file at whichever key source is available.

arc vault set

Store a secret.

Usage

bash
arc vault set <group> <name> <value> [options]
  • --group <group> (required): secret group, e.g. aws, github
  • --name <name> (required): secret name, e.g. token, access-key-id
  • --value <value> (required): the secret value
  • --vault-path <path>: path to the vault file, defaults to the standard location

Example

bash
$ arc vault set demo api-key sk-example-12345 --vault-path ./demo-vault.enc
OK demo/api-key

arc vault get

Read a secret value.

bash
arc vault get <group> <name> [--vault-path <path>]

Example

bash
$ arc vault get demo api-key --vault-path ./demo-vault.enc
sk-example-12345

arc vault list

List secrets. Aliased as arc vault ls.

Usage

bash
arc vault list [group] [options]
  • --group <group>: secret group to list, omit for all groups
  • --vault-path <path>: path to the vault file

Example

bash
$ arc vault list --vault-path ./demo-vault.enc
demo

arc vault delete

Delete a secret or an entire group. Aliased as arc vault rm.

Usage

bash
arc vault delete <group> [name] [options]
  • --group <group> (required): secret group
  • --name <name>: secret name, omit to delete the entire group
  • --vault-path <path>: path to the vault file

Example

bash
$ arc vault delete demo api-key --vault-path ./demo-vault.enc
Deleted demo/api-key