<identity> vault

Manage secrets in the encrypted vault.

<identity> vault [options] [command]

Subcommand	Description
assign	Point an identity at a named vault (several identities may share one)
add	Add or update a secret in the vault (secret read from stdin or a masked prompt when omitted)
list	List all vault items.
get	Get a vault item by name.
status	Check vault connectivity and auth status.
provision	Give an existing barry a vault account (identity create –email only does this at creation)
remove	Delete a secret from the vault.
export	Write every vault item to a plaintext JSON file (for moving to another account)
import	Load items from a vault export file.
restore	Restore a vault backup (vault.db or vault.db.age) — stops the daemon, installs the file, restarts it.

<identity> vault assign

Point an identity at a named vault (several identities may share one)

<identity> vault assign [options] <vault>

Argument	Required
vault	Required

Option	Description
--email <email>	Account email, required the first time a vault is named.

<identity> vault add

Add or update a secret in the vault (secret read from stdin or a masked prompt when omitted)

<identity> vault add [options] <key> [secret]

Argument	Required
key	Required
secret	Optional

Option	Description
--force	Overwrite an existing item even when the vault is shared.
--vault <vault>	Vault to act on directly (mutually exclusive with -i/–identity)

<identity> vault list

List all vault items.

<identity> vault list [options]

Alias: <identity> vault ls.

Option	Description
--vault <vault>	Vault to act on directly (mutually exclusive with -i/–identity)

<identity> vault get

Get a vault item by name.

<identity> vault get [options] <key>

Argument	Required
key	Required

Option	Description
--vault <vault>	Vault to act on directly (mutually exclusive with -i/–identity)

<identity> vault status

Check vault connectivity and auth status.

<identity> vault status [options]

Option	Description
--vault <vault>	Vault to act on directly (mutually exclusive with -i/–identity)

<identity> vault provision

Give an existing barry a vault account (identity create –email only does this at creation)

<identity> vault provision [options]

Option	Description
--email <email>	Email to register the vault account under. Required.
--force	Replace an existing vault account — its secrets become unreachable.

<identity> vault remove

Delete a secret from the vault.

<identity> vault remove [options] <key>

Alias: <identity> vault rm.

Argument	Required
key	Required

Option	Description
--force	Delete even if an env mapping still references it.

<identity> vault export

Write every vault item to a plaintext JSON file (for moving to another account)

<identity> vault export [options]

Option	Description
--out <path>	File to write. Required.

<identity> vault import

Load items from a vault export file.

<identity> vault import [options]

Option	Description
--file <path>	Export file to read. Required.
--overwrite	Replace items that already exist instead of skipping them.

<identity> vault restore

Restore a vault backup (vault.db or vault.db.age) — stops the daemon, installs the file, restarts it.

<identity> vault restore [options] <path>

Argument	Required
path	Required

Option	Description
--dry-run	Verify the snapshot and print what would happen, without touching anything.
--force	Actually perform the restore (required — refuses by default)
--accept-stale	Restore a snapshot older than 30 days anyway.
--age-key-path <path>	Path to the age private key (default: vault-backup-key.txt in the instance’s application support directory)

Every command also accepts -h, --help. All identity commands.