CLI Commands

This page covers common Secryn CLI commands.

List Secrets

secryn secret list

Get a Secret

secryn secret get DB_PASSWORD

Export Secrets as .env

secryn env pull > .env

List Keys

secryn key list

Download a Key

secryn key download KEY_ID --output key.pem

List Certificates

secryn cert list

Download a Certificate

secryn cert download CERT_ID --output cert.pem

Update the CLI

Update the installed Secryn CLI to the latest release:

secryn update

The updater downloads releases from GitHub Releases, verifies the download using the published SHA-256 checksum, and installs it by replacing the current executable.

Use these options to control the update:

# Check whether an update is available without installing it
secryn update --check

# Install a specific release
secryn update --version vX.Y.Z

# Reinstall the release even when it matches the current version
secryn update --force

# Return machine-readable output
secryn update --json

Existing installations must run the installer once to obtain the first release that includes self-update support:

curl -fsSL https://cli.secryn.io | bash

If the CLI is installed in a protected directory, such as /usr/local/bin, updating it may require elevated permissions.

JSON Output

Commands support --json output for scripting and automation.