ManUp CLI
Manage, synchronize, and inject environment secrets seamlessly across your projects and automation pipelines.
⚡ Quickstart
Get started with ManUp CLI in 3 easy steps:
# 1. Install globally
$ npm install -g manup-cli
# 2. Authenticate with your ManUp Vault Server
$ manup login --server http://localhost:7780 --api-key mp_your_key
# 3. Inject vault secrets directly into your application command
$ manup run -- npm start📦 Installation
You can install manup-cli globally via npm, pnpm, or yarn:
npm install -g manup-cliOr run any command statelessly with npx:
npx manup-cli whoami🔑 Authentication (manup login)
Authenticate your local environment with your self-hosted ManUp server instance securely.
Interactive Dual Login
Choose between direct Email/Username & Password login (which auto-generates a dedicated CLI API Key) or an existing API Key (mp_...):
manup loginNon-Interactive Login & Automation
Log in directly with flags or authenticate statelessly in CI/CD pipelines:
# Direct login with credentials flags
manup login --server http://localhost:7780 --user dev@example.com --password mypass
# Non-interactive API key login
manup login --server http://localhost:7780 --api-key mp_your_api_key🔒 Machine-Bound AES Encryption
Credentials stored on disk are encrypted using AES-256-CBC derived from your local machine identity (scrypt hash) with strict POSIX permissions (0600), keeping tokens safe from local process theft.
👤 Status Check (manup whoami)
Displays active server URL, logged-in user email, organization ID, API key scope, project isolation status, and linked directory details.
manup whoami🔗 Workspace Linking (manup init)
Links your current directory to a specific project and environment in your ManUp vault by creating a local .manup.json file.
# Interactive wizard
manup init
# Non-interactive scriptable linking by name
manup init -p backend -e dev🔑 API Key Management (manup keys)
Provision, inspect, and revoke API keys with support for project scoping and role-based access.
# List all active API keys
manup keys
# Create an organization-wide key (read/write)
manup keys create ci-runner
# Create a project-scoped read-only key with 90-day expiration
manup keys create prod-worker --scope read-only --project backend --days 90
# Revoke an API key
manup keys delete <keyId>🔐 Secret Operations (manup secrets)
Full CRUD operations for managing decrypted environment variables in your vault. Supports environment and project targeting by name (e.g. dev, prod), common abbreviations, or ID.
List Secrets
# List masked secrets for linked environment
manup secrets
# Reveal plain values
manup secrets ls --reveal
# Target environment and project by name
manup secrets ls -e dev
manup secrets ls -p backend -e prodSet Secret
# Argument pair or KEY=VALUE syntax
manup secrets set DATABASE_URL postgres://user:pass@localhost:5432/db -e dev
manup secrets set PORT=3000 -e prod -p backendGet Secret
manup secrets get DATABASE_URL -e prodDelete Secret
manup secrets delete OLD_TOKEN -e dev📄 Exporting Secrets
Export environment variables to .env files, standard shell export scripts, or JSON maps.
# Write secrets to .env file by environment name
manup secrets export -e prod --out .env
# Output shell export format
manup secrets export -e dev --format export
# Output JSON format
manup secrets export -e staging --format json🚀 Running Commands (manup run)
Injects decrypted vault secrets directly into the child process environment variables at runtime without saving them to disk.
# Inject secrets into Node.js application (linked environment)
manup run -- node server.js
# Inject secrets into npm dev server
manup run -- npm run dev
# Switch environment on the fly by name
manup run -e dev -- npm start
manup run -e prod -- npm test
manup run -p backend -e staging -- npm run build