tigby vault
Store the secrets an agent acts with
Values are encrypted before they reach the database: one data key per Org, wrapped by a key the database does not hold. Tigby can decrypt them, because it acts for the agent with them – this is application-layer encryption, not zero-knowledge, and it is worth having for exactly what it protects: a stolen dump or backup.
tigby vault set
Write a secret.
Creates the name or replaces what it held. Leave the value off and it is read from stdin, which keeps it out of the shell's history and out of the process list.
tigby vault set <name> [value] [options]| Argument | What it is |
|---|---|
<name> | Lowercase letters, digits, dots, dashes and underscores. |
<value> | The secret itself. Read from stdin when absent. (optional) |
| Option | What it does |
|---|---|
--identity <handle> | The Identity whose namespace to use. Without it, an Admin Key uses the Org's namespace and an Identity Key its own. |
--description <text> | What this secret is for; not secret, and shown in the list. |
tigby vault set shop-token s3cret
pass show shop/api | tigby vault set shop-token --identity shopbottigby vault list
List a namespace's secrets.
Names, sizes and dates. No value is ever in a list.
tigby vault list [options]| Option | What it does |
|---|---|
--identity <handle> | The Identity whose namespace to use. Without it, an Admin Key uses the Org's namespace and an Identity Key its own. |
tigby vault get
Print a secret's value.
Writes the value to stdout and nothing else, so it can be piped or captured.
tigby vault get <name> [options]| Argument | What it is |
|---|---|
<name> | The secret to read. |
| Option | What it does |
|---|---|
--identity <handle> | The Identity whose namespace to use. Without it, an Admin Key uses the Org's namespace and an Identity Key its own. |
tigby vault get shop-tokentigby vault delete
Remove a secret.
Immediate, and the only copy of the value goes with it.
tigby vault delete <name> [options]| Argument | What it is |
|---|---|
<name> | The secret to remove. |
| Option | What it does |
|---|---|
--identity <handle> | The Identity whose namespace to use. Without it, an Admin Key uses the Org's namespace and an Identity Key its own. |
This command cannot be undone, so it asks before it acts. --yes answers in advance; --json implies it.