BlogReleasesIssuesDocsDownloadsStatusLooking GlassContact Sales

clavitor-cli render

render reads a file that contains clavitor:// references, replaces each one with the value from the vault, and writes the result to stdout. Use it to give a program a config file with secrets in it, without ever writing that file to disk.

Usage

clavitor-cli render <file>
clavitor-cli render -          # read the template from stdin

Example

A template, app.config.json:

{
  "openai_key":  "clavitor://OpenAI/key",
  "stripe_key":  "clavitor://Stripe/key",
  "db_password": "clavitor://Production-DB/password"
}

Render it straight into the program:

clavitor-cli render app.config.json | myapp --config -

Reference syntax

A reference is clavitor://<entry title>/<field label>.

  • The entry title is matched exactly, ignoring case, and must match one entry. There is no fuzzy matching here, so clavitor://prod/password will not pick up an entry called "nonprod".
  • The field is the part after the last /, so a title may itself contain /. The field label match ignores case. notes reads the entry's notes.
  • A reference ends at a space, tab, newline, ", ', , or }. That covers JSON, YAML, INI and .env files.
  • Because a space ends the reference, even inside quotes, render cannot reach an entry whose title contains a space or any of those characters. Give entries you render from titles without them, such as Production-DB.

A file with no references is passed through unchanged.

Limits

  • At most 10 distinct entries per run, and at most 128 references in total. render is for config files, not for pulling a vault's contents. Split larger configs across runs.
  • Each distinct entry counts against the client's read quota once.
  • The template may be at most 256 KiB.

When something fails

render is all or nothing. If any reference is malformed, cannot be found, matches more than one entry, names a missing field, points at an L3 field, or fails to decrypt, render prints an error with the line number and writes no output at all. A config with a hole where a secret should be never reaches your program.

Keep the output away from logs

The rendered output contains secrets. Pipe it to the program that reads it. Do not save it to a file, and do not let an agent print it. render prints a reminder on stderr each time it fills in values.