Credentials & configuration

Run nvault login to authenticate via a browser device-code flow — your account password is never typed into the terminal. For CI, create a scoped token in Settings → CLI Tokens and pass it with --token or NVAULT_TOKEN. The login persists in OS-appropriate secure storage. Your vault passphrase is a separate secret that unlocks encryption per session and is never stored.

Non-interactive use

Every command accepts --json for machine-readable output and returns a meaningful exit code. Pass --yes to skip confirmation prompts in automation, and --no-input to fail rather than prompt.

Using it in CI

CLI access requires a Pro or Team plan. For CI, create a scoped, revocable machine token in the web app (Settings → CLI Tokens) and expose it as NVAULT_TOKEN. Provide the vault passphrase as a masked secret. The runner fetches config for exactly one step and nothing is persisted into the workspace.

# GitHub Actions
- run: nvault run --project portfolio-analytics -- pnpm test
  env:
    NVAULT_TOKEN: ${{ secrets.NVAULT_TOKEN }}
    NVAULT_PASSPHRASE: ${{ secrets.NVAULT_PASSPHRASE }}

Design principles

• Credentials are stored in OS-appropriate secure storage, never in plaintext config.
• Authentication uses a browser/device flow — your account password is never typed into the CLI.
• Tokens are not printed unnecessarily, keeping secrets out of shell history and scrollback.
• Commands return meaningful exit codes and run non-interactively when asked.
• Project detection is deterministic and explained: it tells you which remote matched which project.
• Local files are never overwritten without an explicit prompt and a backup.

Availability

The web application and CLI are both available today. Web and CLI are backed by the same domain model, so behaviour stays identical across both. Read more in The CLI is a product, not an afterthought.