See the CLI documentation for installation and commands.

apivault logs --source integration

Learn more in the logs command reference.

apivault run and apivault env export now use the token's environment pin when you don't pass --env:

APIVAULT_TOKEN=av_live_... apivault run -- npm run build

Previously they sent the environment from your local config, which a pinned token refused, and they failed outright in a fresh container with no config. An explicit --env still wins, so a mismatch shows up as an error.

Commands no longer hang

• keys add: reports missing values by flag name instead of prompting, and --environment falls back to the token's pin.
• keys delete: without -f, it refuses and names the flag. Deleting can't be undone, so an absent human doesn't count as agreement.
• keys update: prompts for every field, so it now says it needs a terminal.
• Custom vault keys: a command that can't prompt for one points you to --vault-key and APIVAULT_KEY.

Clearer service token errors

• A rejected token no longer suggests apivault login. An unrecognized APIVAULT_TOKEN says the value didn't match a token, which usually means a truncated copy or a secret set on the wrong repository.
• apivault projects list and apivault logs now refuse up front under a service token.
• apivault whoami always states the token's reach: Production only for a pinned token, or All environments.

The README now covers headless use, including GitHub Actions and Docker examples. Learn more in the CI/CD documentation.

APIVAULT_TOKEN=av_live_... apivault run -- npm run build

Two commands also change while the variable is set:

• apivault whoami reports the token's name, project, scopes, and environment pin, so a pipeline can check which credential it picked up.
• apivault login and apivault logout refuse to run and explain why. Login would otherwise write a device token the next command ignored, and logout would clear one the caller never asked to sign out.

Learn more in the CI/CD documentation.

apivault logs

The default view is a table with the time, status, HTTP method, endpoint, source, actor, duration, and event. To stream new CLI events:

apivault logs --follow --source cli

Illustrative stream output with demo identities, key IDs, times, and durations:

[14:05:12] 200 POST /api/keys cli 24ms [KEY_CREATED] (developer@example.com)
[14:05:18] 200 DELETE /api/keys/demo-key cli 18ms [KEY_DELETED] (developer@example.com)

Use Ctrl+C to stop following. To narrow the list or inspect one entry:

apivault logs --status error --source mcp
apivault logs --method POST --search "/api/keys"
apivault logs get <log-id>

Inspection shows the entry's user agent, IP address, and details payload. Pass --json for machine-readable output, or use event, user, key, and date filters described in the command reference.

Log endpoints can also now resolve a project by ID or slug.

Learn more in the logs command reference.

apivault whoami shows that date and highlights it in yellow with a renewal reminder once fewer than 14 days remain. apivault --json whoami adds a tokenExpiresAt field.

Clearer errors

• Rejected requests: an expired token reports the date it lapsed, and a missing or revoked one says so.
• Rate limits: wrong vault keys are throttled by the server, so keys get --reveal, keys add, env export, and run now tell you how long to wait, such as "try again in 7m".
• No arguments: running apivault alone distinguishes an expired token from being signed out.

Fixes

• --project and apivault projects use now accept a project slug as well as an ID.
• The CLI's local key masking now matches the web app's, so a locally masked value and a server preview can't render differently.

Learn more in the login command reference.

# Link the current directory to a project
apivault link <id>

# See the active project and where it came from
apivault projects current

# Remove the link
apivault unlink

apivault projects use <id> now links the current directory by default. Pass --global to set a system-wide default instead.

Config scopes

All apivault config commands now accept --local (-l) and --global (-g). Local settings take precedence over global ones.

A minimal project file can hold the project binding and run defaults without storing credentials. Replace your-project-id with the ID from apivault projects list:

{
  "project": "your-project-id",
  "run": {
    "env": "Development",
    "command": "npm run dev"
  }
}

Warning: Check this file before committing it. A vaultKey field contains a secret. If you store one locally, add the file to .gitignore; otherwise keep it out of the repository and supply the vault key through the prompt, APIVAULT_KEY, or global configuration. apivault config set vaultKey can write to the local file when one exists.

Learn more in the project linking guide.

Learn more in the keys command reference.

Learn more in the keys command reference.

# List your projects
apivault projects list

# Set the default project
apivault projects use <project-id>

# Override it for one command
apivault run -p <project-id> -- npm start

Every command accepts the global -p, --project <id> flag, and key management, run, and env commands all use the active project.

To bind a repository to a project, add an .apivaultrc or apivault.json file containing the project ID.

Learn more in the projects command reference.

npm install -g apivault@0.1.3

The standalone scripts also moved to install.sh and install.ps1. Those URLs install the current version rather than a fixed historical release.

Learn more in the installation guide.

apivault --version now reads the version from package.json. To inspect this release:

npm install -g apivault@0.1.2
apivault --version

Learn more in the CLI documentation.

See the CLI documentation for installation and commands.

The first release of the apivault CLI runs your application with secrets injected directly into its process environment, without writing a plaintext .env file to disk.

npm install -g apivault@0.1.0
apivault login
apivault run -- npm run dev

Note: This example installs the original release, which used the previous API domain. CLI v0.1.3 changed the default to apivault.tech. For current setup instructions, see the installation guide.

Core features

• Key management: apivault keys list, add, get, update, and delete.
• Environment exports: apivault env export and apivault env restore when local .env files are explicitly needed.
• Local configuration: apivault config get, set, and list for defaults in ~/.apivault/config.json.
• Custom vault keys: supply a vault key for encrypted vaults that require one.

apivault run passes values to the child process without creating a plaintext .env file. The env export command explicitly writes an environment file; the child process can also write the values it receives.

Authentication tokens are stored in ~/.apivault/token.json, with 0600 permissions on Unix-like systems.

Learn more in the CLI documentation.