CLI

tigby vault

Store the secrets an agent acts with

Values are encrypted before they reach the database: one data key per Org, wrapped by a key the database does not hold. Tigby can decrypt them, because it acts for the agent with them – this is application-layer encryption, not zero-knowledge, and it is worth having for exactly what it protects: a stolen dump or backup.

tigby vault set

Write a secret.

Creates the name or replaces what it held. Leave the value off and it is read from stdin, which keeps it out of the shell's history and out of the process list.

tigby vault set <name> [value] [options]
ArgumentWhat it is
<name>Lowercase letters, digits, dots, dashes and underscores.
<value>The secret itself. Read from stdin when absent. (optional)
OptionWhat it does
--identity <handle>The Identity whose namespace to use. Without it, an Admin Key uses the Org's namespace and an Identity Key its own.
--description <text>What this secret is for; not secret, and shown in the list.
tigby vault set shop-token s3cret
pass show shop/api | tigby vault set shop-token --identity shopbot

tigby vault list

List a namespace's secrets.

Names, sizes and dates. No value is ever in a list.

tigby vault list [options]
OptionWhat it does
--identity <handle>The Identity whose namespace to use. Without it, an Admin Key uses the Org's namespace and an Identity Key its own.

tigby vault get

Print a secret's value.

Writes the value to stdout and nothing else, so it can be piped or captured.

tigby vault get <name> [options]
ArgumentWhat it is
<name>The secret to read.
OptionWhat it does
--identity <handle>The Identity whose namespace to use. Without it, an Admin Key uses the Org's namespace and an Identity Key its own.
tigby vault get shop-token

tigby vault delete

Remove a secret.

Immediate, and the only copy of the value goes with it.

tigby vault delete <name> [options]
ArgumentWhat it is
<name>The secret to remove.
OptionWhat it does
--identity <handle>The Identity whose namespace to use. Without it, an Admin Key uses the Org's namespace and an Identity Key its own.

This command cannot be undone, so it asks before it acts. --yes answers in advance; --json implies it.