The cli. Decrypt environment variable sets and load them into any process

Unsupported. You may be interested in keys-cli
Last updated a year ago by lrrrgg .
GPL-3.0-only · Repository · Bugs · Original npm · Tarball · package.json
$ cnpm install keys-cm 
SYNC missed versions from official npm registry.

keys - client

This is the keys core client, which can be installed with npm and provides the keys command line utility. is a repository that stores encrypted blobs of environment variables. You can store variable sets for your software in the repository, and fetch-decrypt-load them at runtime. This prevents your sensitive environment variables like API access keys from ever having to sit in plain text files on your systems and developer machines.

The repository functions similarly to modern password managers, and does not have access to your environment variables, they are decrypted locally after you fetch the blob. Don't lose your password!


You should have an account at if you want to interact with the repository.

Linux Build Dependencies

Before npm install, you may have to install python2 and libsecret

sudo apt-get install libsecret-1-dev # Debian/Ubuntu
sudo yum install libsecret-devel # Red Hat-based
sudo pacman -S libsecret # Arch Linux


Install the package with npm. This will provide a new command in your shell, called keys

npm install -g keys-cm


Just prefix any command you want to run with keys. Environment variables will be downloaded, decrypted, and your command will be executed, now having access to them.

$ keys ./ -a 1 -b 2
keys 2.1.8
Loaded credentials from keychain
AuthSuccess for
Choose the environment to load:
[1] myapp-dev
[2] myapp-prod
[3] otherapp-dev
Executing: ./ -a 1 -b 2 # process now has access to AWS_SECRET_ACCESS_KEY
$ keys java -jar mything.jar
$ keys gunicorn app:app
$ keys bin/rails server -e production -p 4000


-e | --environment environment-name Specifies the environment to load, skipping the prompt which asks for it.

-v | --verbose Enable verbose mode, printing debugging messages about what is going on.

-c | --clean By default, keys will append environment variables to your current shell environment before running your command. This flag will run your command with only the variables from the selected environment.

-i | --import Pipe lines of variables key=value into stdin to import variables to an environment specified by -e. This will overwrite the environment

echo "VAR1=ABC\nVAR2=DEF" | keys -i -e myenv
heroku config -s | keys -i -e myenv

-t | --token specifies that the KEYS_TOKEN variable in the local environment should be read for an access token for a specific environment. This will bypass normal username/password authentication.

KEYS_TOKEN=abc123 keys -t command

--reset Reset credentials and settings from ~/.keys/settings.json

Access Tokens

Sometimes you need to execute things non-interactively. Create an access token for a specific environment at and use that instead of username/password. This is less secure than interactive authentication, but the server/container state, IP address, and other system data are used to detect suspicious circumstances and deny access and/or notify you appropriately.

$ keys -t env_access_token ./ -myoption myvalue

...or in the local environment:

$ KEYS_TOKEN=env_access_token keys -t ./ -myoption myvalue


This project is licensed under the GNU General Public License v3.0

Current Tags

  • 2.1.8                                ...           latest (a year ago)

9 Versions

  • 2.1.8 [deprecated]           ...           a year ago
  • 2.1.7 [deprecated]           ...           a year ago
  • 2.1.6 [deprecated]           ...           a year ago
  • 2.1.5 [deprecated]           ...           a year ago
  • 2.1.4 [deprecated]           ...           a year ago
  • 2.1.3 [deprecated]           ...           a year ago
  • 2.1.2 [deprecated]           ...           a year ago
  • 2.1.1 [deprecated]           ...           a year ago
  • 2.1.0 [deprecated]           ...           a year ago
Maintainers (1)
Today 0
This Week 0
This Month 0
Last Day 0
Last Week 0
Last Month 0
Dependencies (15)
Dev Dependencies (2)
Dependents (0)

Copyright 2014 - 2017 © |