clavitor-cli put

put creates a new entry in the vault. Secret fields are encrypted on your machine before they are sent.

Usage

clavitor-cli put <type> <title> [--<field> <value>] [--<field>-file <path>] [--urls <url>]
clavitor-cli put --json < entry.json

Examples

A login, with the password read from stdin:

printf '%s' "$NEW_PASSWORD" | clavitor-cli put credential "Staging DB" --username app --password-file -

An API key, read from a file:

clavitor-cli put api "OpenRouter" --key-file ./key.txt --endpoint https://openrouter.ai/api/v1

A whole entry as JSON on stdin:

clavitor-cli put --json <<'EOF'
{
  "type": "database",
  "title": "Production Postgres",
  "host": "db.example.com",
  "port": "5432",
  "username": "app",
  "password": "…",
  "database": "mydb"
}
EOF

On success put prints Created: <title>.

Types and fields

The types are credential, api_key, card, identity, note, ssh_key, totp, software_license, database, wifi, server, crypto_wallet and custom. api and ssh are short for api_key and ssh_key.

Each type has its own field names, for example username, password, totp and urls for a credential. clavitor-cli --show-schema prints the full list. An unknown field name is an error, so a typo cannot silently drop a value.

Secrets never go on the command line

Arguments are visible to other processes and end up in shell history. So:

• Plain fields take a value: --username app.
• Secret fields (password, key, notes, secret, passphrase, card number, and similar) only take a file: --password-file <path>. Use - as the path to read from stdin. put refuses --password <value>. A trailing newline is stripped from a file but not from stdin, which is why the example uses printf '%s' rather than echo.
• With --json, the whole entry comes from stdin. The JSON needs type and title. Every other value must be a string, so write "port": "5432", not 5432. urls may be a string or an array.

What put does not do

• It never updates. Running put again with the same title creates a second entry with that title. To change an entry, edit it in the vault.
• It does not create L3 fields. A field that is L3 in the vault (a card number, for example) is stored as L2 when you create it with put, so the client that wrote it can read it back. Create entries in the vault's web app when a field must be L3.
• Scopes. An entry created by a scoped client gets that client's scopes, so the client can read it back. Change scopes in the vault.

The vault records every put in its audit log, under the client's name.