The API Stronghold CLI lets you manage API keys, generate environment files, sync secrets to cloud providers, and control access — all from the command line. Available for macOS, Linux, and Windows.
Install the CLI with a single command. It auto-detects your platform and adds itself to your PATH.
Run this command in your terminal:
curl -fsSL https://www.apistronghold.com/cli/install.sh | sh /usr/local/bin/ (if writable) or ~/.local/bin/ curl and wget Run this command in Command Prompt:
curl -fsSL https://www.apistronghold.com/cli/install.cmd -o install.cmd && install.cmd && del install.cmd %USERPROFILE%\.api-stronghold\bin\ If you're using Git Bash, WSL, or another Unix-like shell on Windows, use the same command as macOS/Linux:
curl -fsSL https://www.apistronghold.com/cli/install.sh | sh The shell installer detects Windows environments (MINGW, MSYS, Cygwin) and installs accordingly.
Authenticate once, then use the CLI non-interactively in scripts, containers, and CI/CD pipelines.
Non-interactive authentication for scripts, containers, and CI/CD. Create an agent identity in the dashboard and authenticate with its token.
api-stronghold-cli auth api-user --token <TOKEN> Interactive OAuth login that opens your browser. Tokens auto-refresh so you stay logged in.
api-stronghold-cli login .env in under 10 minutes
Goal: install → login → write a .env.
If your vault is empty, the middle steps create the minimum so env-file works.
curl -fsSL https://www.apistronghold.com/cli/install.sh | sh Windows (cmd):
curl -fsSL https://www.apistronghold.com/cli/install.cmd -o install.cmd && install.cmd && del install.cmd api-stronghold-cli login Opens the browser. One time. Tokens refresh on their own.
api-stronghold-cli key create DEMO_KEY demo-valueapi-stronghold-cli deployment create localapi-stronghold-cli deployment add-mapping local DEMO_KEY DEMO_KEY
Swap DEMO_KEY / demo-value for a real secret when you're ready. The shape is the same.
api-stronghold-cli deployment env-file local .env
You should see something like: secrets written to .env. That's the win.
Someone grants you a deployment. Then it's just:
api-stronghold-cli loginapi-stronghold-cli deployment listapi-stronghold-cli deployment env-file <name> .envdeployment list empty → you need a key + deployment (step 3), or an invite from your adminlogin fails → check the browser window; retry api-stronghold-cli loginEverything you need to manage secrets from the command line. New here? Start with first win.
| Command | Description |
|---|---|
key list | List all API keys you have access to |
key get <name> | Decrypt and retrieve a specific key value |
key create <name> <value> | Create a new API key |
key update <id> <name> <value> | Update an existing key |
key delete <id> | Delete an API key |
| Command | Description |
|---|---|
deployment list | List all deployment profiles |
deployment create <name> | Create a deployment (defaults provider=none, projectId=<name>, environment=dev) |
deployment sync <id> | Sync secrets to a deployment (GitHub, Vercel, Cloudflare) |
deployment sync --all | Sync all deployment profiles at once |
deployment env-file <deployment> <path> | Generate a .env file from a deployment |
deployment env-file <deployment> --stdout | Output export statements for eval usage |
deployment add-mapping <deployment> <key> <envVar> | Map a key to an environment variable (name or id) |
deployment list-mappings <deploymentId> | View all key mappings for a deployment |
| Command | Description |
|---|---|
group list | List all user groups |
group create <name> | Create a new user group |
group add-members <groupId> <userId> | Add members to a group |
group assign-api-keys <groupId> <keyIds> | Control which keys a group can access |
group assign-deployments <groupId> <deploymentIds> | Assign deployment profiles to a group |
group my-resources | View keys and deployments accessible to you |
| Flag | Description |
|---|---|
--api-url <url> | Override the API endpoint |
--config <path> | Custom config file path (default: ~/.api-stronghold/config.yaml) |
--version, -v | Show CLI version |
--help, -h | Show help for any command |
Practical examples for everyday usage.
Pull secrets from a deployment profile and write them to a local .env file.
api-stronghold-cli deployment env-file prod .env Export secrets as environment variables without writing a file. Ideal for container entrypoints and CI/CD.
eval $(api-stronghold-cli deployment env-file prod --stdout) Push secrets to GitHub Actions, Vercel, or Cloudflare in a single command.
# Sync one deploymentapi-stronghold-cli deployment sync <deployment-id># Sync all deploymentsapi-stronghold-cli deployment sync --allAuthenticate with an agent identity token and inject secrets at build time.
# Authenticate (store token as a CI secret)api-stronghold-cli auth api-user --token $API_STRONGHOLD_TOKEN# Load secrets and run your buildeval $(api-stronghold-cli deployment env-file prod --stdout)npm run buildThe CLI is built with zero-knowledge encryption at its core.
All keys are encrypted client-side with AES-256-GCM before leaving your machine. The server never sees plaintext values.
Key exclusion rules are enforced on the server. The CLI only ever receives keys the user is authorized to access.
Stored credentials use PBKDF2 with 310,000 iterations for key derivation. Tokens auto-refresh without re-prompting.
Session tokens refresh automatically in the background. No manual re-authentication needed for long-running processes.
Install the CLI and start managing your secrets from the terminal in minutes.