Skip to content
Subako Docs
Esc
↑↓navigate↵open⌘Jpreview
On this page

subako vault

Vaults: where a session's tool credentials live

CLI reference

subako vault

Vaults: where a session’s tool credentials live

Usage

Usage: subako vault <COMMAND>

Subcommands

Options

--help

Print help

  • Short option: -h.

subako vault create

Create a vault in the selected workspace

Usage

Usage: subako vault create [OPTIONS] --display-name <DISPLAY_NAME>

Options

--display-name <DISPLAY_NAME>

  • Required.

--metadata <METADATA>

JSON file of arbitrary metadata to store alongside the vault

--profile <PROFILE>

Credential profile to act as. Defaults to the current one

--credentials-file <CREDENTIALS_FILE>

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.

--help

Print help

  • Short option: -h.

subako vault list

List the selected workspace’s vaults

Usage

Usage: subako vault list [OPTIONS]

Options

--profile <PROFILE>

Credential profile to act as. Defaults to the current one

--credentials-file <CREDENTIALS_FILE>

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.

--help

Print help

  • Short option: -h.

subako vault show

Read one vault: its label, its metadata, and whether it still takes new credentials. Never a payload

Usage

Usage: subako vault show [OPTIONS] <VAULT_ID>

Arguments

<VAULT_ID>

  • Required.

Options

--profile <PROFILE>

Credential profile to act as. Defaults to the current one

--credentials-file <CREDENTIALS_FILE>

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.

--help

Print help

  • Short option: -h.

subako vault update

Change a vault’s label, its metadata, or both. What is not named is left as it stands

Usage

Usage: subako vault update [OPTIONS] <VAULT_ID>

Arguments

<VAULT_ID>

  • Required.

Options

--name <NAME>

New label for the vault

--metadata <METADATA>

JSON file of metadata to store in place of the current document

--profile <PROFILE>

Credential profile to act as. Defaults to the current one

--credentials-file <CREDENTIALS_FILE>

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.

--help

Print help

  • Short option: -h.

subako vault add-credential

Add a credential to a vault. Its payload is read from stdin as JSON, so the secrets in it stay out of your shell history

Usage

Usage: subako vault add-credential [OPTIONS] --protocol <PROTOCOL> --target <TARGET> --display-name <DISPLAY_NAME> <VAULT_ID>

Arguments

<VAULT_ID>

  • Required.

Options

--protocol <PROTOCOL>

  • Required.

--target <TARGET>

What the broker matches a tool call against. For mcp, the server’s exact URL

  • Required.

--display-name <DISPLAY_NAME>

  • Required.

--profile <PROFILE>

Credential profile to act as. Defaults to the current one

--credentials-file <CREDENTIALS_FILE>

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.

--help

Print help

  • Short option: -h.

subako vault credentials

List a vault’s credentials. Never their payloads

Usage

Usage: subako vault credentials [OPTIONS] <VAULT_ID>

Arguments

<VAULT_ID>

  • Required.

Options

--profile <PROFILE>

Credential profile to act as. Defaults to the current one

--credentials-file <CREDENTIALS_FILE>

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.

--help

Print help

  • Short option: -h.

subako vault protocols

List the protocols this server accepts for a credential. --protocol takes a spelling, so this is where the live set is discovered

Usage

Usage: subako vault protocols [OPTIONS]

Options

--profile <PROFILE>

Credential profile to act as. Defaults to the current one

--credentials-file <CREDENTIALS_FILE>

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.

--help

Print help

  • Short option: -h.

subako vault delete

Permanently delete a vault and every credential in it

Usage

Usage: subako vault delete [OPTIONS] <VAULT_ID>

Arguments

<VAULT_ID>

  • Required.

Options

--yes

Skip the typed confirmation. For scripts that have already asked

  • Default: false.

--profile <PROFILE>

Credential profile to act as. Defaults to the current one

--credentials-file <CREDENTIALS_FILE>

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.

--help

Print help

  • Short option: -h.

subako vault delete-credential

Delete a credential, revoking access and freeing its target for replacement

Usage

Usage: subako vault delete-credential [OPTIONS] <VAULT_ID> <CREDENTIAL_ID>

Arguments

<VAULT_ID>

  • Required.

<CREDENTIAL_ID>

  • Required.

Options

--yes

Skip the typed confirmation. For scripts that have already asked

  • Default: false.

--profile <PROFILE>

Credential profile to act as. Defaults to the current one

--credentials-file <CREDENTIALS_FILE>

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.

--help

Print help

  • Short option: -h.

Was this page helpful?