CLI reference

The CLI is how local development and CI/CD talk to Cloak — a single machine token scopes every command to exactly one project and environment, so there's no separate "switch context" step.

Install

The official Cloak CLI package is published on npm as usecloak-cli ↗.

npm install -g usecloak-cli

Get a token

In the dashboard, go to Tokens → Create token, pick the project, environment, and access level, and copy the value — it's shown exactly once.

Log in

cloak login cloak_live_xxxxxxxx

Optional: Custom API URL

The CLI automatically defaults to the production Cloak API. You only need to pass the optional --api-url http://localhost:3000/api/cli flag when testing against a custom or local development server.

Every command

cloak login <token>Verify a machine token and save it locally (in ./.cloak/ by default, or --global for ~/.cloak/).

cloak logout [--global]Remove saved credentials.

cloak whoamiShow the token's name, access level, and which project/environment it's scoped to.

cloak secrets listList secret keys with masked previews for the token's scoped environment.

cloak secrets pull [--format env|json]Print resolved, decrypted secrets — for scripting or piping to a file.

cloak secrets set KEY=valueCreate or update a secret. Requires a Read / Write token.

cloak secrets import [--from .env]Bulk-import an existing .env file. Requires a Read / Write token.

cloak secrets delete KEYDelete a secret. Requires a Read / Write token.

cloak run -- <command>Run a command with secrets injected into its environment — nothing written to disk.

cloak run --watch -- <command>Same as run, but polls every 5s and restarts the process when an upstream secret changes.

Works with any stack

Replace the command after -- with however you normally start your app — Cloak doesn't need to know what it is.

cloak run -- npm run dev          # Node / Next.js / Express
cloak run -- npm start            # React Native / Expo
cloak run -- yarn dev
cloak run -- python manage.py runserver   # Django
cloak run -- flask run                    # Flask
cloak run -- rails server                 # Ruby on Rails
cloak run -- go run main.go               # Go
cloak run -- ./your-binary                # anything else

CI/CD

Skip cloak login entirely — set env vars in your CI provider instead:

CLOAK_TOKEN=cloak_live_xxxx \
CLOAK_API_URL=https://usecloak.top/api/cli \
cloak run -- npm run build

One token, one scope

Unlike some tools, there's no cloak use command to switch projects or environments — each token is already scoped to exactly one project/environment pair when it's created. Working across multiple environments means holding multiple tokens (e.g. one for development, one for production) and picking which one to log in with.

Local config files and environment overrides.

Configuration

→