CLI

wardkey is the command-line client for the Wardkey API. One signed binary, no config wizard. It handles two jobs:

Day-to-day developer commands — wardkey login, wardkey secrets get/set, wardkey whoami.
CI / runtime secret injection — wardkey exec -- <command> fetches the right secrets, exports them as environment variables, and runs your command. Replaces .env files entirely.

It talks to api.wardkey.app over HTTPS. Tokens live in your OS keyring (macOS Keychain, Linux Secret Service / KWallet, Windows Credential Manager) — never on disk in plaintext.

Install

# Linux (apt / dnf — auto-detected)
curl -fsSL https://packages.wardkey.app/install.sh | sudo sh

Windows MSI and manual repo setup are on the Install page. macOS isn't shipping a signed build yet — build from source in the meantime.

First run

wardkey login                          # device-flow auth in your browser
wardkey secrets set db/password --value 'hunter2'
wardkey secrets get db/password        # → hunter2
wardkey exec -- ./deploy.sh            # DB_PASSWORD set in deploy.sh's env

Commands

Command	What it does
`wardkey login`	Authenticate via OIDC device flow; stores a token in your OS keyring.
`wardkey logout`	Clear the local token (does not revoke server-side).
`wardkey whoami`	Print the active identity and org memberships.
`wardkey secrets list`	List every secret path in the active org.
`wardkey secrets get`	Read the plaintext value of a secret (current or historical version).
`wardkey secrets set`	Write a secret (creates the path or appends a new version).
`wardkey secrets delete`	Soft-delete a secret. Alias: `wardkey secrets rm`.
`wardkey exec`	Inject secrets as env vars and run a command. The primary CI surface.

Every command honors the global flags — --api, --org, --project, --env, --json.