← All posts
2 min readThe nvault team

Logging in without typing a password into your terminal

Pasting your account password into a CLI is a bad habit with real consequences. The device authorization flow gives the terminal access without ever seeing your credentials.

clisecurity

Prompting for a password in a CLI seems harmless. It is not, quite:

  • Passwords typed into a terminal can land in shell history, in scrollback, in a screen recording, or in a CI log.
  • A CLI that handles your password is a much more attractive supply-chain target.
  • It trains people to paste their most important credential into whatever asks for it.

The device flow

Instead, nvault login uses a browser-based device authorization flow — the same pattern smart TVs use to sign you into streaming apps:

$ nvault login

Open:  https://nvaults.vercel.app/device
Code:  X7KD-29PL

Waiting for authentication...
✓ Device authenticated
  1. The CLI asks the server to start a device authorization and gets back a short user code.
  2. You open the URL in a browser — on the same machine or your phone — sign in there (where your password manager works), and enter the code.
  3. The CLI has been polling; once you approve, it receives its own tokens. Your password was never in the terminal.

What the CLI stores

The result of login is a CLI access token (evk_…) — not your password, and not your vault passphrase, which is a separate secret you still supply per session to unlock encryption. That token is stored with owner-only file permissions in your per-user config directory (or injected via NVAULT_TOKEN in CI). Revoke it from Settings → CLI Tokens or run nvault logout to revoke it on the server immediately.

Revocation

Every device that logs in shows up in the web app as a session, with its last-seen time. You can revoke any one of them — or all sessions except the current one — and the tokens stop working immediately. A lost laptop is a two-click problem, not a password-reset scramble.

CLI tokens are long-lived credentials scoped to terminal access. Revoke any device from Settings → CLI Tokens or with nvault logout — the token stops working on the next request.
The safest place to type your password is the one place already built to handle it: the browser, with your password manager.

Your development environment, available anywhere.

Create a vault, push your first project, and restore it anywhere.

Get started freeHow it stays secure

Related reading