CLI

Connect to this KMS instance from anywhere. Inject env vars into a process, pull values into a .env file, or manage backups.

One-line install (Linux / macOS)

curl -fsSL https://kms.tissue.works/api/cli/install.sh | sh

Installs to ~/.local/share/kms/kms-cli with a shim at ~/.local/bin/kms. Requires Node.js 20+ and curl.

Manual download

Download kms-cli.tar.gz (8.4 KB)

tar -xzf kms-cli.tar.gz
sudo ln -sf "$PWD/kms-cli/bin/kms" /usr/local/bin/kms
kms --help

Quick start

# 1. Sign in (interactive — uses your KMS account)
kms login --server https://kms.tissue.works

# 2. Or use a project API token (recommended for CI/servers):
export KMS_SERVER=https://kms.tissue.works
export KMS_TOKEN=kmst_xxx        # created in Project → API tokens

# 3. Inject secrets into a process
kms run --env prod -- node server.js

# 4. Or write to a .env file
kms pull --env dev > .env.dev

# 5. List secret keys (no values)
kms list --env dev

Unsigned distribution

This server is distributing an unsigned kms-cli. Set KMS_CLI_SIGNING_KEY at build time and KMS_CLI_PUBLIC_KEY at runtime to enable detached minisign verification.

Backup / restore (admins)

kms backup --out kms-$(date +%F).kbk
kms restore --in kms-2026-05-01.kbk
kms rekey   # re-wraps every project DEK under a new master key