Getting started

The Stashbase CLI keeps secure agent and environment work in your terminal:

Run coding agents in a sandbox with scoped access to credentials, APIs, tools, and files: stashbase agent run. See Agents.
Give agents the schema, not the values with a value-free description of an environment: stashbase secrets schema pull. See Environment schema.
Run your apps with secrets injected into the process: stashbase run.
Catch hard-coded secrets before they are committed or pushed, including by agents: stashbase scan.
Manage projects, environments, secrets, and webhooks, with output in multiple formats for scripting.

Installation

Platform support:

macOS Apple Silicon
Linux x64
Windows x64

macOS

You can install Stashbase CLI using Homebrew:

brew tap stashbase/homebrew-stashbase
brew trust stashbase/stashbase
brew install stashbase

Linux

You can install Stashbase CLI using curl:

curl -fsSL https://stashbase.dev/cli/install.sh | bash

Windows

You can install Stashbase CLI using Scoop:

scoop bucket add stashbase https://github.com/stashbase/scoop-stashbase
scoop install stashbase

Shell script

This method of installing Stashbase CLI works with both Linux and macOS.

curl -fsSL https://stashbase.dev/cli/install.sh | bash

To authorize your CLI you need to provide API Key. You can generate personal API Key by using the web dashboard navigating to API Keys -> Personal -> Add new. Store the generated API Key safely because you won't be able to view it again.

For a single workspace, use the built-in default credential profile. To authorize it, provide your generated API key to the command below, which prompts you for the key interactively:

stashbase config api-key set

Credential profiles

Use credential profiles when you work with more than one Stashbase workspace. Each profile has its own API key in your operating system's secure credential store. The CLI configuration stores only profile metadata, such as the profile name and optional workspace label.

# Create a named profile and enter its API key when prompted
stashbase config profile add acme --workspace acme-production

# Make it the default profile for future commands
stashbase config profile use acme

# Select a profile for one command or an automation run
STASHBASE_PROFILE=acme stashbase projects list

Stashbase resolves the profile from STASHBASE_PROFILE, then the configured default profile, and finally the backwards-compatible default profile. --api-key and STASHBASE_API_KEY take precedence over the selected profile's stored API key, which is useful in CI.

stashbase setup also asks for a profile name and pre-fills default; press Enter to keep the standard single-workspace setup.

Usage

To verify that your CLI is working correctly, run the following command in your favorite shell: stashbase If everything works as expected, you should see usage information and all available root commands.

If you need help with any command you can use stashbase <command> --help argument to get more information.

Instead of typing stashbase every time we recommend to create a custom alias like sb:

alias sb="stashbase"

Global options

The CLI supports those global options that can be used with any command.

Prop

Type