clavitor-cli get

get reads one entry from the vault and prints it, or prints a single field's value for use in a script.

Usage

clavitor-cli get <title> [--field <label>] [--json] [--fuzzy] [--type <entry type>]

Examples

Print one field's value. This is the form to use in scripts:

clavitor-cli get "GitHub" --field password | docker login -u bot --password-stdin

Use it inside the command that needs it, so the value is never printed on its own:

curl -H "Authorization: Bearer $(clavitor-cli get OpenRouter --field key)" https://openrouter.ai/api/v1/models

Print the whole entry, one label: value line per field, with L2 fields decrypted:

clavitor-cli get "GitHub"

Two entries with the same title, such as a console login and its API key, are told apart by type:

clavitor-cli get "Hetzner" --type api --field key

Options

Flag	What it does
`--field <label>`	Print only this field's value: raw, no label, no trailing newline. The label match ignores case.
`--json`	Print the vault's record for the entry as JSON. L2 values stay encrypted in this output.
`--fuzzy`	Match on part of the title instead of the whole title.
`--type <type>`	Only consider entries of this type: `credential`, `api_key`, `note`, `ssh_key`, `totp` and so on. `api` and `ssh` are short for `api_key` and `ssh_key`.

How the entry is found

The title must match exactly one entry. The match is exact and ignores case. With --fuzzy, any title that contains the text matches, and the text must be at least four characters long.

Entries outside the client's scopes do not match at all. If nothing matches, get says so. If several entries match, get lists their titles when there are five or fewer, and otherwise gives only the count. Then fetch the one you want by its exact title, or narrow with --type. Don't know the title? clavitor-cli find <name> lists the matching titles without reading any values.

Every lookup counts against the client's read quota, and the vault records it in the audit log. Reading the same entry again within the window does not use more quota. A --fuzzy lookup that matches several entries also uses one unit. See agent setup for the limits.

Fields

L1 fields print as stored.
L2 fields are decrypted on your machine with the key from enrollment. If a field fails to decrypt, get stops with error CV-2049 naming the field and prints nothing else.
L3 fields are never released to the CLI. Without --field, they show as [L3 — requires hardware key]. With --field, asking for an L3 field is an error.

An entry's notes can be read as --field notes. Its web addresses are available as --field url, joined by commas.

Keep values out of logs

Without --field, get prints secret values to the terminal. That is meant for a person at a keyboard. In scripts and agents, use --field inside the command that consumes the value, as in the examples above. Avoid storing the value in an environment variable: child processes inherit it, and other processes can often read it.