@keywaysh/cli 0.5.1 → 0.5.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +185 -16
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -1,37 +1,206 @@
|
|
|
1
|
-
#
|
|
1
|
+
# Keyway CLI
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
**Stop sharing `.env` files on Slack.** GitHub access = secret access.
|
|
4
4
|
|
|
5
|
-
|
|
5
|
+
[](https://github.com/keywaysh/cli/releases/latest)
|
|
6
|
+
[](https://github.com/keywaysh/cli/actions/workflows/ci.yml)
|
|
7
|
+
[](https://codecov.io/github/keywaysh/cli)
|
|
8
|
+
[](https://goreportcard.com/report/github.com/keywaysh/cli)
|
|
9
|
+
[](LICENSE)
|
|
10
|
+
[](https://www.keyway.sh/vaults/keywaysh/cli)
|
|
11
|
+
|
|
12
|
+
---
|
|
13
|
+
|
|
14
|
+
## The Problem
|
|
15
|
+
|
|
16
|
+
You're still doing this:
|
|
17
|
+
- Pasting secrets in Slack DMs
|
|
18
|
+
- Emailing `.env` files to new devs
|
|
19
|
+
- Rotating every secret when someone leaves
|
|
20
|
+
- Manually copying vars to Vercel/Railway/Netlify
|
|
21
|
+
|
|
22
|
+
## The Solution
|
|
23
|
+
|
|
24
|
+
```bash
|
|
25
|
+
keyway pull
|
|
26
|
+
```
|
|
27
|
+
|
|
28
|
+
That's it. If you have access to the repo, you have access to the secrets. No invites, no training, no friction.
|
|
29
|
+
|
|
30
|
+
---
|
|
31
|
+
|
|
32
|
+
## Install
|
|
33
|
+
|
|
34
|
+
### Homebrew (macOS & Linux)
|
|
35
|
+
|
|
36
|
+
```bash
|
|
37
|
+
brew install keywaysh/tap/keyway
|
|
38
|
+
```
|
|
39
|
+
|
|
40
|
+
### Install Script
|
|
41
|
+
|
|
42
|
+
```bash
|
|
43
|
+
curl -fsSL https://get.keyway.sh | sh
|
|
44
|
+
```
|
|
45
|
+
|
|
46
|
+
### npx (no install)
|
|
6
47
|
|
|
7
48
|
```bash
|
|
8
49
|
npx @keywaysh/cli init
|
|
9
50
|
```
|
|
10
51
|
|
|
11
|
-
|
|
52
|
+
### Direct download
|
|
53
|
+
|
|
54
|
+
Grab the binary for your platform from [Releases](https://github.com/keywaysh/cli/releases/latest).
|
|
12
55
|
|
|
13
|
-
|
|
56
|
+
---
|
|
57
|
+
|
|
58
|
+
## Quick Start
|
|
14
59
|
|
|
15
60
|
```bash
|
|
16
|
-
|
|
17
|
-
npx @keywaysh/cli run # Run command with secrets injected
|
|
18
|
-
npx @keywaysh/cli push # Push .env to vault
|
|
19
|
-
npx @keywaysh/cli sync # Sync with Vercel/Railway
|
|
61
|
+
keyway init
|
|
20
62
|
```
|
|
21
63
|
|
|
22
|
-
|
|
64
|
+
This will:
|
|
65
|
+
1. Authenticate with GitHub
|
|
66
|
+
2. Create an encrypted vault for your repo
|
|
67
|
+
3. Push your local `.env` to the vault
|
|
68
|
+
|
|
69
|
+
New teammate joins? They run `keyway pull`. Done in 30 seconds.
|
|
70
|
+
|
|
71
|
+
---
|
|
23
72
|
|
|
24
|
-
|
|
73
|
+
## How It Works
|
|
25
74
|
|
|
26
75
|
```bash
|
|
27
|
-
|
|
28
|
-
keyway
|
|
76
|
+
keyway init # First time: create vault, push secrets
|
|
77
|
+
keyway push # Update remote secrets
|
|
78
|
+
keyway pull # Get latest secrets
|
|
79
|
+
keyway sync vercel # Deploy to Vercel, Railway, Netlify
|
|
80
|
+
```
|
|
81
|
+
|
|
82
|
+
### Zero-Trust Mode
|
|
83
|
+
|
|
84
|
+
Never write secrets to disk. Inject them directly into your process:
|
|
85
|
+
|
|
86
|
+
```bash
|
|
87
|
+
keyway run -- npm start
|
|
88
|
+
keyway run --env production -- ./my-app
|
|
89
|
+
```
|
|
90
|
+
|
|
91
|
+
Secrets exist only in memory. When the process exits, they're gone.
|
|
92
|
+
|
|
93
|
+
---
|
|
94
|
+
|
|
95
|
+
## Security
|
|
96
|
+
|
|
97
|
+
Your secrets are protected by:
|
|
98
|
+
|
|
99
|
+
| Layer | Protection |
|
|
100
|
+
|-------|------------|
|
|
101
|
+
| **Encryption** | AES-256-GCM with random IV per secret |
|
|
102
|
+
| **At Rest** | Encrypted in database, keys in isolated service |
|
|
103
|
+
| **In Transit** | TLS 1.3 everywhere |
|
|
104
|
+
| **Access Control** | GitHub collaborator API — no separate user management |
|
|
105
|
+
| **Audit Trail** | Every pull and view is logged with IP and location |
|
|
106
|
+
|
|
107
|
+
We can't read your secrets. Even if our database leaks, attackers get encrypted blobs.
|
|
108
|
+
|
|
109
|
+
[Read our security whitepaper →](https://www.keyway.sh/security)
|
|
110
|
+
|
|
111
|
+
---
|
|
112
|
+
|
|
113
|
+
## Commands
|
|
114
|
+
|
|
115
|
+
| Command | Description |
|
|
116
|
+
|---------|-------------|
|
|
117
|
+
| `keyway init` | Create vault and push initial secrets |
|
|
118
|
+
| `keyway push` | Push local secrets to vault |
|
|
119
|
+
| `keyway pull` | Pull secrets from vault |
|
|
120
|
+
| `keyway set KEY=VALUE` | Set a single secret in the vault |
|
|
121
|
+
| `keyway run` | Run command with secrets injected (zero-trust) |
|
|
122
|
+
| `keyway diff` | Compare local vs remote secrets |
|
|
123
|
+
| `keyway sync` | Sync to Vercel, Railway, Netlify |
|
|
124
|
+
| `keyway connect` | Connect to a provider (Vercel, Railway) |
|
|
125
|
+
| `keyway connections` | List connected providers |
|
|
126
|
+
| `keyway disconnect` | Remove a provider connection |
|
|
127
|
+
| `keyway scan` | Scan repo for leaked secrets |
|
|
128
|
+
| `keyway login` | Authenticate with GitHub |
|
|
129
|
+
| `keyway logout` | Clear stored credentials |
|
|
130
|
+
| `keyway doctor` | Diagnose environment issues |
|
|
131
|
+
|
|
132
|
+
---
|
|
133
|
+
|
|
134
|
+
## Environment Variables
|
|
135
|
+
|
|
136
|
+
| Variable | Description |
|
|
137
|
+
|----------|-------------|
|
|
138
|
+
| `KEYWAY_TOKEN` | Auth token for CI/CD (use `keyway login --ci`) |
|
|
139
|
+
| `KEYWAY_API_URL` | Custom API endpoint |
|
|
140
|
+
| `KEYWAY_DISABLE_TELEMETRY=1` | Disable anonymous analytics |
|
|
141
|
+
|
|
142
|
+
---
|
|
143
|
+
|
|
144
|
+
## Why Keyway?
|
|
145
|
+
|
|
146
|
+
- **30 seconds** to onboard a new developer
|
|
147
|
+
- **0 secrets** to rotate when someone leaves (just revoke GitHub access)
|
|
148
|
+
- **1 command** to deploy secrets to production
|
|
149
|
+
- **GitHub-native** — no new accounts, no new permissions to manage
|
|
150
|
+
|
|
151
|
+
---
|
|
152
|
+
|
|
153
|
+
## CI/CD
|
|
154
|
+
|
|
155
|
+
Use an API key for automation:
|
|
156
|
+
|
|
157
|
+
```bash
|
|
158
|
+
# Generate an API key (Dashboard > Settings > API Keys)
|
|
159
|
+
# Use scope "read:secrets" for CI — least privilege principle
|
|
160
|
+
```
|
|
161
|
+
|
|
162
|
+
```yaml
|
|
163
|
+
# GitHub Actions example
|
|
164
|
+
env:
|
|
165
|
+
KEYWAY_TOKEN: ${{ secrets.KEYWAY_TOKEN }}
|
|
166
|
+
run: keyway pull --env production
|
|
29
167
|
```
|
|
30
168
|
|
|
31
|
-
|
|
169
|
+
Or use the [GitHub Action](https://github.com/keywaysh/keyway-action):
|
|
170
|
+
|
|
171
|
+
```yaml
|
|
172
|
+
- uses: keywaysh/keyway-action@v1
|
|
173
|
+
with:
|
|
174
|
+
token: ${{ secrets.KEYWAY_TOKEN }}
|
|
175
|
+
environment: production
|
|
176
|
+
```
|
|
177
|
+
|
|
178
|
+
---
|
|
179
|
+
|
|
180
|
+
## Development
|
|
181
|
+
|
|
182
|
+
```bash
|
|
183
|
+
# Prerequisites: Go 1.22+
|
|
184
|
+
|
|
185
|
+
make build # Build → ./bin/keyway
|
|
186
|
+
make test # Run tests
|
|
187
|
+
make lint # Run golangci-lint
|
|
188
|
+
make install # Install to /usr/local/bin/keyway
|
|
189
|
+
```
|
|
190
|
+
|
|
191
|
+
Releases are automated via GoReleaser on tag push.
|
|
192
|
+
|
|
193
|
+
---
|
|
194
|
+
|
|
195
|
+
## Links
|
|
196
|
+
|
|
197
|
+
- [Documentation](https://docs.keyway.sh)
|
|
198
|
+
- [Dashboard](https://keyway.sh)
|
|
199
|
+
- [Security](https://keyway.sh/security)
|
|
200
|
+
- [Status](https://status.keyway.sh)
|
|
32
201
|
|
|
33
|
-
|
|
202
|
+
---
|
|
34
203
|
|
|
35
204
|
## License
|
|
36
205
|
|
|
37
|
-
MIT
|
|
206
|
+
MIT — see [LICENSE](LICENSE)
|