npm package: @secr/cli
Description: CLI for secr — secrets management for teams
Latest version: 0.3.0

# @secr/cli

**Stop committing `.env` files. Start managing secrets properly.**

secr is a CLI-first secrets manager for development teams. Encrypt, sync, and inject environment variables across your team — without writing them to disk.

[![npm version](https://img.shields.io/npm/v/@secr/cli.svg)](https://www.npmjs.com/package/@secr/cli)
[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)

**[Website](https://secr.dev)** · **[Docs](https://secr.dev/docs)** · **[Dashboard](https://app.secr.dev)** · **[Blog](https://secr.dev/blog)**

---

## Why secr?

- **No more `.env` files in Slack** — secrets are encrypted and synced automatically
- **Zero-disk injection** — `secr run` injects secrets into your process without writing to disk
- **Onboard in 30 seconds** — new developer? `npm i -g @secr/cli && secr login && secr run`
- **Leak prevention built in** — scan your codebase for credentials and block commits with leaked secrets
- **Enterprise SSO** — SAML, OIDC, SCIM directory sync, MFA, and passkeys via WorkOS
- **Free for small teams** — 3 projects, unlimited users, no credit card

## Install

```bash
# Homebrew (macOS / Linux)
brew tap secr-dev/secr
brew install secr

# npm / pnpm / yarn
npm install -g @secr/cli
```

## Quick start

```bash
# 1. Authenticate (opens browser — supports SSO)
secr login

# 2. Create a project
secr init

# 3. Add secrets
secr set DATABASE_URL=postgres://localhost/mydb
secr set STRIPE_KEY=sk_live_...

# 4. Run your app with secrets injected (nothing on disk)
secr run "npm start"
```

That's it. Every team member gets the same secrets, always in sync.

## What you can do

### Manage secrets

```bash
secr set KEY=value                  # Set a secret
secr set --from-env .env            # Bulk import from .env file
secr pull                           # Pull all secrets
secr pull --format dotenv > .env    # Export as .env
secr ls                             # List secret keys
secr delete KEY1 KEY2               # Delete secrets
secr diff staging production        # Compare environments
secr promote staging production     # Copy secrets between environments
```

### Prevent leaks

```bash
secr scan                           # Scan codebase for 20+ credential patterns
secr scan --pre-commit              # Check staged files only
secr guard install                  # Install git pre-commit hook
secr guard status                   # Check hook status
```

### Import from anywhere

```bash
secr migrate .env                   # Import from .env files
secr import --from vercel           # Import from Vercel
secr import --from heroku           # Import from Heroku
secr import --from aws-sm           # Import from AWS Secrets Manager
secr import --from render           # Import from Render
secr import --from railway          # Import from Railway
secr import --from netlify          # Import from Netlify
secr import --from github           # Import from GitHub Actions
secr import --from cloudflare       # Import from Cloudflare Pages
secr import --from fly              # Import from Fly.io
secr import --from digitalocean     # Import from DigitalOcean
secr import --from supabase         # Import from Supabase
secr import --from aws-ps           # Import from AWS Parameter Store
```

### Share secrets securely

```bash
secr share "sk_live_abc123"              # One-time encrypted link
secr share "token" --expires 24h         # Expires in 24 hours
secr share "key" --views 5 --label "DB"  # 5 views max, labeled
secr share --list                        # View active share links
secr share --revoke <id>                 # Revoke a link
```

### Team and org management

```bash
secr org create "Acme Corp"         # Create an organization
secr env list                       # List environments
secr env create custom-env          # Create a custom environment
secr template list                  # View required key templates
secr template validate              # Check secrets match template
secr log                            # View audit trail
```

### Integrations

```bash
secr postman connect                # Sync secrets to Postman
secr postman sync                   # Push latest secrets to Postman
secr config export --output bak.json  # Export project config
secr config import config.json      # Import project config
secr completion bash                # Shell completions (bash/zsh/fish)
```

## Authentication

secr supports two authentication modes:

- **SSO (SAML/OIDC)** — `secr login` opens your identity provider in the browser. Supports Okta, Azure AD, Google Workspace, and any SAML 2.0 / OIDC provider via WorkOS.
- **Email/password** — browser-based login with callback to the CLI.
- **CI/CD tokens** — `secr login --token <token>` for non-interactive environments.

## Platform integrations

secr works with your existing stack:

| Platform | Package |
|----------|---------|
| Vercel | [`@secr/vercel`](https://www.npmjs.com/package/@secr/vercel) |
| Netlify | [`@secr/netlify-plugin`](https://www.npmjs.com/package/@secr/netlify-plugin) |
| GitHub Actions | [secr-dev/secr-action](https://github.com/secr-dev/secr-action) |
| Terraform | [secr provider](https://secr.dev/docs/terraform) |
| Postman | Built-in (`secr postman connect`) |

**SDKs**: [TypeScript](https://www.npmjs.com/package/@secr/sdk) · [Python](https://pypi.org/project/secr/) · [Go](https://pkg.go.dev/github.com/secr-dev/secr/sdks/go/secr)

## Security

- **AES-256-GCM** envelope encryption with per-project keys wrapped by AWS, GCP, or Azure KMS
- **Zero disk** — `secr run` injects via environment variables, nothing written to `.env`
- **RBAC** — owner, admin, developer, viewer roles with environment-level permissions
- **Audit trail** — every access, change, and rotation is logged
- **Secret scanning** — 20+ patterns including AWS keys, GitHub tokens, Stripe keys, JWTs
- **SSO/SCIM** — enterprise identity management via WorkOS
- **MFA & passkeys** — WebAuthn-based authentication

## All commands

| Command | Description |
|---------|-------------|
| `secr login` | Authenticate (SSO or browser) |
| `secr init` | Create a new project |
| `secr link` | Link to an existing project |
| `secr set` | Set one or more secrets |
| `secr pull` | Pull decrypted secrets |
| `secr run` | Run a command with secrets injected |
| `secr ls` | List secret keys |
| `secr delete` | Delete one or more secrets |
| `secr diff` | Compare environments |
| `secr promote` | Copy secrets between environments |
| `secr template` | Manage required key templates |
| `secr scan` | Scan for leaked credentials |
| `secr guard` | Install/manage pre-commit hook |
| `secr env` | Manage environments |
| `secr rotate-key` | Rotate project encryption key |
| `secr log` | View audit log |
| `secr share` | Create encrypted share links |
| `secr migrate` | Import from .env files |
| `secr import` | Import from 12+ cloud providers |
| `secr postman` | Postman sync integration |
| `secr org` | Manage organizations |
| `secr config` | Export/import project config |
| `secr completion` | Shell completions (bash/zsh/fish) |

## Comparison

| Feature | secr | dotenv | Doppler | Vault |
|---------|------|--------|---------|-------|
| Encrypted at rest | AES-256-GCM | No | Yes | Yes |
| Zero-disk injection | Yes | No | Yes | No |
| Secret scanning | 20+ patterns | No | No | No |
| Pre-commit hook | Yes | No | No | No |
| Provider import | 12+ providers | No | Limited | No |
| Free tier | 3 projects, unlimited users | N/A | 5 users | OSS only |
| SSO/SCIM | Yes (WorkOS) | No | Enterprise | Enterprise |

## Documentation

Full documentation at **[secr.dev/docs](https://secr.dev/docs)**.

- [Getting started](https://secr.dev/docs/setup)
- [CLI reference](https://secr.dev/docs/cli)
- [API reference](https://secr.dev/docs/api)
- [Security architecture](https://secr.dev/docs/security)
- [Self-hosting](https://secr.dev/docs/deployment)

## License

MIT