---
title: "subako vault"
description: "Vaults: where a session's tool credentials live"
---

[CLI reference](/cli)

## `subako vault`

Vaults: where a session's tool credentials live

### Usage

```text
Usage: subako vault <COMMAND>
```

### Subcommands

- [`subako vault create`](#subako-vault-create)
- [`subako vault list`](#subako-vault-list)
- [`subako vault show`](#subako-vault-show)
- [`subako vault update`](#subako-vault-update)
- [`subako vault add-credential`](#subako-vault-add-credential)
- [`subako vault credentials`](#subako-vault-credentials)
- [`subako vault protocols`](#subako-vault-protocols)
- [`subako vault delete`](#subako-vault-delete)
- [`subako vault delete-credential`](#subako-vault-delete-credential)

### Options

#### `--help`

Print help

- Short option: `-h`.

## `subako vault create`

Create a vault in the selected workspace

### Usage

```text
Usage: subako vault create [OPTIONS] --display-name <DISPLAY_NAME>
```

### Options

#### `--display-name <DISPLAY_NAME>`

- Required.

#### `--metadata <METADATA>`

JSON file of arbitrary metadata to store alongside the vault


#### `--profile <PROFILE>`

Credential profile to act as. Defaults to the current one


#### `--credentials-file <CREDENTIALS_FILE>`

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.


#### `--help`

Print help

- Short option: `-h`.

## `subako vault list`

List the selected workspace's vaults

### Usage

```text
Usage: subako vault list [OPTIONS]
```

### Options

#### `--profile <PROFILE>`

Credential profile to act as. Defaults to the current one


#### `--credentials-file <CREDENTIALS_FILE>`

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.


#### `--help`

Print help

- Short option: `-h`.

## `subako vault show`

Read one vault: its label, its metadata, and whether it still takes new credentials. Never a payload

### Usage

```text
Usage: subako vault show [OPTIONS] <VAULT_ID>
```

### Arguments

#### `<VAULT_ID>`

- Required.

### Options

#### `--profile <PROFILE>`

Credential profile to act as. Defaults to the current one


#### `--credentials-file <CREDENTIALS_FILE>`

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.


#### `--help`

Print help

- Short option: `-h`.

## `subako vault update`

Change a vault's label, its metadata, or both. What is not named is left as it stands

### Usage

```text
Usage: subako vault update [OPTIONS] <VAULT_ID>
```

### Arguments

#### `<VAULT_ID>`

- Required.

### Options

#### `--name <NAME>`

New label for the vault


#### `--metadata <METADATA>`

JSON file of metadata to store in place of the current document


#### `--profile <PROFILE>`

Credential profile to act as. Defaults to the current one


#### `--credentials-file <CREDENTIALS_FILE>`

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.


#### `--help`

Print help

- Short option: `-h`.

## `subako vault add-credential`

Add a credential to a vault. Its payload is read from stdin as JSON, so the secrets in it stay out of your shell history

### Usage

```text
Usage: subako vault add-credential [OPTIONS] --protocol <PROTOCOL> --target <TARGET> --display-name <DISPLAY_NAME> <VAULT_ID>
```

### Arguments

#### `<VAULT_ID>`

- Required.

### Options

#### `--protocol <PROTOCOL>`

- Required.

#### `--target <TARGET>`

What the broker matches a tool call against. For `mcp`, the server's exact URL

- Required.

#### `--display-name <DISPLAY_NAME>`

- Required.

#### `--profile <PROFILE>`

Credential profile to act as. Defaults to the current one


#### `--credentials-file <CREDENTIALS_FILE>`

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.


#### `--help`

Print help

- Short option: `-h`.

## `subako vault credentials`

List a vault's credentials. Never their payloads

### Usage

```text
Usage: subako vault credentials [OPTIONS] <VAULT_ID>
```

### Arguments

#### `<VAULT_ID>`

- Required.

### Options

#### `--profile <PROFILE>`

Credential profile to act as. Defaults to the current one


#### `--credentials-file <CREDENTIALS_FILE>`

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.


#### `--help`

Print help

- Short option: `-h`.

## `subako vault protocols`

List the protocols this server accepts for a credential. `--protocol` takes a spelling, so this is where the live set is discovered

### Usage

```text
Usage: subako vault protocols [OPTIONS]
```

### Options

#### `--profile <PROFILE>`

Credential profile to act as. Defaults to the current one


#### `--credentials-file <CREDENTIALS_FILE>`

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.


#### `--help`

Print help

- Short option: `-h`.

## `subako vault delete`

Permanently delete a vault and every credential in it

### Usage

```text
Usage: subako vault delete [OPTIONS] <VAULT_ID>
```

### Arguments

#### `<VAULT_ID>`

- Required.

### Options

#### `--yes`

Skip the typed confirmation. For scripts that have already asked

- Default: `false`.

#### `--profile <PROFILE>`

Credential profile to act as. Defaults to the current one


#### `--credentials-file <CREDENTIALS_FILE>`

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.


#### `--help`

Print help

- Short option: `-h`.

## `subako vault delete-credential`

Delete a credential, revoking access and freeing its target for replacement

### Usage

```text
Usage: subako vault delete-credential [OPTIONS] <VAULT_ID> <CREDENTIAL_ID>
```

### Arguments

#### `<VAULT_ID>`

- Required.

#### `<CREDENTIAL_ID>`

- Required.

### Options

#### `--yes`

Skip the typed confirmation. For scripts that have already asked

- Default: `false`.

#### `--profile <PROFILE>`

Credential profile to act as. Defaults to the current one


#### `--credentials-file <CREDENTIALS_FILE>`

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.


#### `--help`

Print help

- Short option: `-h`.