Sigyn CLI Reference

Complete command reference for the sigyn binary.

sigyn <COMMAND> [OPTIONS]

Global Flags

These flags can be used with any subcommand:

Resolution priority: CLI flags > ~/.sigyn/context.toml > .sigyn.toml (project dir) > ~/.sigyn/project.toml > ~/.sigyn/config.toml > defaults.

Command Aliases

Most commands have short aliases for quick typing:

Environment Prefix Matching

Environment names support unambiguous prefix matching. If your vault has dev, staging, and prod environments:

sigyn secret get API_KEY -e d    # resolves to 'dev'
sigyn secret get API_KEY -e p    # resolves to 'prod'
sigyn secret get API_KEY -e s    # resolves to 'staging'
sigyn secret get API_KEY -e st   # also resolves to 'staging'

Ambiguous prefixes produce an error listing the matches.

Environment Variables

get (shortcut)

Get a secret value. This is a shortcut for sigyn secret get.

sigyn get DATABASE_URL -e dev
sigyn get API_KEY --copy           # copy to clipboard
sigyn get API_KEY -e prod --json

Uses the global --env / -e flag for environment selection.

set (shortcut)

Set a secret value. This is a shortcut for sigyn secret set.

sigyn set DATABASE_URL 'postgres://localhost/mydb' -e dev
echo 'supersecret' | sigyn set API_KEY -e prod

Uses the global --env / -e flag for environment selection.

ls (quick list)

Quick listing of secrets, vaults, or environments.

sigyn ls                    # list secrets in default env
sigyn ls prod               # list secrets in 'prod' env (prefix matching)
sigyn ls --vaults           # list all vaults
sigyn ls --envs             # list all environments
sigyn ls dev --reveal       # list secrets with values shown

identity (alias: id)

Manage cryptographic identities (X25519 + Ed25519 keypairs).

identity create

Create a new identity with a passphrase-protected keypair.

sigyn identity create --name alice
sigyn identity create --name alice --email [email protected]

Prompts for a passphrase (minimum 8 characters) with confirmation.

identity list

List all identities on this machine.

sigyn identity list
sigyn id list --json

identity show

Show details of a specific identity (name, email, fingerprint, creation date).

sigyn identity show alice
sigyn identity show                  # uses default identity
sigyn identity show a1b2c3d4...     # by fingerprint

identity change-passphrase

Change the passphrase for an existing identity. Verifies the old passphrase, then re-wraps the keys with a fresh salt. Clears the agent cache after success.

sigyn identity change-passphrase alice
sigyn identity change-passphrase          # uses default identity

Prompts for current passphrase, then new passphrase with confirmation (minimum 8 characters).

identity delete

Delete an identity from this machine. Requires passphrase to prove ownership. Before deleting, checks whether the identity is a member of any local vaults.

sigyn identity delete alice
sigyn identity delete a1b2c3d4... --force

If the identity is a member of vaults, the command errors with the vault list unless --force is used. Interactive mode shows a confirmation prompt.

identity rotate-keys

Create a new keypair with a new fingerprint, replacing the old identity. The old identity is deleted only after the new one is successfully created.

sigyn identity rotate-keys
sigyn identity rotate-keys alice
sigyn identity rotate-keys alice --force   # required non-interactively

Warning: This creates a new fingerprint. You must be re-invited to all vaults after rotation. There is no automatic migration — vault headers are not re-encrypted with the new key.

To prevent silently locking yourself out, rotation now refuses if the identity is a member or owner of any local vault (for a vault you own, no one else can re-invite you). Move or drop those vault memberships first, or pass --force to override. --force is also required to rotate non-interactively (e.g. with SIGYN_PASSPHRASE set).

Sharing identities. There is no identity export / identity import command. Public keys are exchanged through delegation: the owner runs sigyn delegation invite --pubkey <fingerprint> … and the invitee accepts with sigyn delegation accept <invitation>. See Team Collaboration.

vault (alias: v)

Manage encrypted vaults.

vault create

Create one or more vaults. The caller’s identity becomes the Owner. Generates a random 256-bit master key and seals it to the creator’s X25519 public key.

sigyn vault create myapp
sigyn vault create myapp --remote-url [email protected]:team/secrets.git
sigyn vault create frontend backend worker --org acme -i alice

Accepts multiple names for batch creation. All vaults share the same --org and flags. Creates the vault directory with vault.toml, members.cbor, policy.cbor, default environments (dev, staging, prod), and an audit log. After creation, Sigyn prints suggested next steps and offers to create a .sigyn.toml project config in the current directory (interactive terminals only, single vault only).

Naming rules: Vault and environment names must be 1-64 characters, contain only [a-zA-Z0-9-_], and cannot start with . or contain ...

vault clone

Clone a shared vault from a remote git repository. Derives the local vault name from the URL (strips trailing .git), or use --name to override. Optionally accepts a delegation invitation in the same command for single-step onboarding.

sigyn vault clone [email protected]:team/myapp-vault.git
sigyn vault clone https://github.com/team/vault.git --name myapp
sigyn vault clone [email protected]:team/vault.git --invitation ./invitation-abc123.json
sigyn vault clone [email protected]:team/vault.git --branch develop

After cloning, the vault’s rollback-protection checkpoint is recorded automatically.

vault list

List all vaults on this machine with their environments.

sigyn vault list

vault open

Open (unlock) a vault for the current session.

sigyn vault open myapp

vault delete

Delete a vault and all its data. Owner-only. Writes an audit entry and attempts a sync push before destroying the directory. Removes the vault from the pinned vaults store.

sigyn vault delete myapp
sigyn vault delete myapp --force

In interactive mode, you must type the vault name to confirm (not just yes/no). If other members exist, the command errors unless --force is used.

vault info

Show vault metadata (UUID, owner fingerprint, environments, creation date).

sigyn vault info myapp
sigyn vault info                     # uses default vault
sigyn vault info myapp --json

vault transfer

Transfer ownership of a vault to another member. This is phase 1 of a two-phase transfer. The new owner must already be a member of the vault.

sigyn vault transfer myapp --to a1b2c3d4e5f6...
sigyn vault transfer myapp --to a1b2c3d4e5f6... --downgrade-to admin
sigyn vault transfer myapp --to a1b2c3d4e5f6... --downgrade-to remove

Creates a signed pending_transfer.cbor recording the intended transfer. The vault’s manifest and policy are not changed until the new owner accepts — the old owner retains full control in the interim. Transfers expire after 7 days.

vault accept-transfer

Accept a pending ownership transfer (phase 2). Verifies the old owner’s signature, checks the transfer has not expired, then atomically updates the manifest owner, adjusts the policy (downgrading/removing the old owner), re-signs the header and policy with the new owner’s signing key, and updates the TOFU pin.

sigyn vault accept-transfer myapp

If the transfer has expired, the pending file is removed and the old owner must initiate a new transfer.

vault export

Export a vault as an encrypted tar.gz archive. All data on disk is already encrypted, so the archive contains no plaintext secrets. Requires Admin+ access.

sigyn vault export myapp -o backup.tar.gz
sigyn vault export myapp --output /backups/myapp-2025.tar.gz

secret (alias: s)

Manage secrets within a vault environment.

secret set

Set one or more secrets. Supports KEY VALUE, KEY=VALUE, or multiple KEY=VALUE pairs. Reads from stdin if a single key is given with no value.

sigyn secret set DATABASE_URL 'postgres://localhost/mydb' --env dev
sigyn secret set DATABASE_URL='postgres://localhost/mydb' --env dev
sigyn secret set DB_URL=postgres://localhost API_KEY=sk-123 REDIS=redis://localhost -e dev
echo 'supersecret' | sigyn secret set API_KEY --env prod

secret import (alias: imp)

Import secrets from a .env file.

sigyn secret import .env --env dev
sigyn secret import .env.production --env prod --force
cat secrets.env | sigyn secret import - --env dev

secret get

Retrieve and decrypt a secret value.

sigyn secret get DATABASE_URL --env dev
sigyn secret get API_KEY --env prod --json
sigyn secret get API_KEY --env dev --copy    # copy to clipboard

JSON output includes key, value, type, environment, and version. With --copy, JSON output includes "copied": true instead of the value.

secret list

List all secrets in an environment. Values are hidden by default.

sigyn secret list --env dev
sigyn secret list --env dev --reveal

secret remove (aliases: rm, delete, del)

Delete one or more secrets from an environment.

sigyn secret remove OLD_KEY --env dev
sigyn secret delete UNUSED_VAR --env staging
sigyn secret rm OLD_KEY1 OLD_KEY2 OLD_KEY3 -e dev

secret generate

Generate a random secret and store it.

sigyn secret generate JWT_SECRET --env dev
sigyn secret generate API_TOKEN --env dev --length 64 --type hex
sigyn secret generate SESSION_ID --env dev --type uuid

secret edit

Open all secrets in an environment in $EDITOR for batch editing. On save, shows a diff of changes (added, modified, removed keys) and asks for confirmation.

sigyn secret edit --env dev
EDITOR=nano sigyn secret edit --env staging

secret search

Search for secrets matching a glob pattern across all environments in a vault.

sigyn secret search 'DB_*'
sigyn secret search 'API_*' --reveal
sigyn secret search '*_URL' --json

Supports * (match any) and ? (match single character) wildcards.

secret history

Show the change history of a secret.

sigyn secret history DATABASE_URL --env dev

secret copy

Copy secrets between vaults (or between environments in different vaults). Supports glob patterns for key matching. Each vault is unlocked separately, and both sides are audited.

sigyn secret copy DATABASE_URL --from-vault app1 --to-vault app2
sigyn secret copy 'DB_*' 'API_*' --from-vault src --to-vault dst --from-env prod --to-env staging

Secrets are decrypted from the source vault and re-encrypted with the destination vault’s key. Requires Read access on source and Write access on destination. Audit entries are written on both sides (SecretRead on source, SecretsCopied on destination).

env (alias: e)

Manage environments within a vault.

env list

List all environments in a vault.

sigyn env list
sigyn env list --vault myapp

env create

Create one or more environments.

sigyn env create qa
sigyn env create staging canary prod --vault myapp

env diff

Compare secrets between two environments. Shows added, removed, and changed keys.

sigyn env diff dev staging
sigyn env diff dev prod --reveal
sigyn env diff staging prod --json

env clone

Clone all secrets from one environment to a new environment.

sigyn env clone dev qa
sigyn env clone staging canary

env promote

Copy secrets from one environment to another. Reports promoted, overwritten, and skipped keys.

sigyn env promote --from dev --to staging
sigyn env promote --from dev --to staging,prod              # chained: dev→staging→prod
sigyn env promote --from staging --to prod --keys DATABASE_URL,API_KEY

env delete

Delete an environment and all its secrets. Requires Admin+ access. Cannot delete the last environment in a vault.

sigyn env delete qa
sigyn env delete canary --force

Removes the environment file, updates the manifest, and cleans up the header’s env_slots. The deletion is audited.

policy (alias: p)

Manage access policies, members, and RBAC rules.

policy show

Display the vault policy: owner, audit mode, all members with their roles, allowed environments, secret patterns, and delegation chain.

sigyn policy show
sigyn policy show --vault myapp --json

policy member-add

Add a member to the vault policy. The member’s delegated_by is automatically set to the caller’s fingerprint.

sigyn policy member-add a1b2c3d4e5f6... --role contributor --envs dev,staging
sigyn policy member-add a1b2c3d4e5f6... --role readonly --envs '*' --patterns 'DB_*,API_*'

policy member-remove

Remove a member from the vault policy.

sigyn policy member-remove a1b2c3d4e5f6...

policy check

Test whether a specific access request would be allowed or denied.

sigyn policy check a1b2c3d4e5f6... read --env dev
sigyn policy check a1b2c3d4e5f6... write --env prod --key DATABASE_URL

Actions: read, write, delete, manage-members, manage-policy, create-env, promote.

policy history

Show policy-related events from the audit log. Filters for member invitations, revocations, policy changes, ownership transfers, and environment creation/deletion.

sigyn policy history
sigyn policy history -n 100
sigyn policy history --json

policy audit-mode

Set the vault’s audit push mode. Requires ManagePolicy access (owner or admin).

sigyn policy audit-mode offline
sigyn policy audit-mode online
sigyn policy audit-mode best-effort

The mode is stored in the signed policy.cbor — members cannot tamper with it.

policy require-mfa

Set per-action MFA requirements on global constraints.

sigyn policy require-mfa read,write,delete
sigyn policy require-mfa all
sigyn policy require-mfa none

policy member-require-mfa

Set per-action MFA requirements on a specific member.

sigyn policy member-require-mfa a1b2c3d4e5f6... read,write

mfa

Manage TOTP-based multi-factor authentication for identities.

mfa setup

Enroll TOTP-based MFA for an identity. Generates a TOTP secret, displays the otpauth:// URI for your authenticator app, then verifies with a code. On success, generates 8 single-use backup codes.

sigyn mfa setup -i alice

mfa disable

Disable MFA for an identity. Requires a valid TOTP code or backup code to confirm.

sigyn mfa disable -i alice

mfa status

Show MFA enrollment status, including whether a session is active and how many backup codes remain.

sigyn mfa status -i alice

mfa backup

Generate a new set of 8 backup codes, invalidating any previous codes. Requires a valid TOTP code to confirm.

sigyn mfa backup -i alice

delegation (alias: member)

Manage the delegation tree and invitations.

delegation tree

Display the delegation tree showing who invited whom.

sigyn delegation tree
sigyn member tree --vault myapp

Example output:

alice (a1b2c3d4...) [owner]
  bob (e5f6a7b8...) [admin]
    carol (c9d0e1f2...) [contributor]
  dave (a3b4c5d6...) [manager]

delegation invite

Create a signed invitation file for a new member. The invitation is an Ed25519-signed JSON document that can be shared out-of-band (email, chat, etc.) or saved to the vault directory for git-based sharing.

sigyn delegation invite --pubkey <FP> --role contributor --envs dev,staging
sigyn delegation invite --pubkey <FP> --role readonly --envs '*'
sigyn delegation invite --pubkey <FP> --role operator --save-to-vault

When --save-to-vault is used, the invitation is written to <vault>/invitations/<uuid>.json. After sigyn sync push, the invitee can sigyn vault clone the repo and accept using the UUID.

delegation accept

Accept an invitation and join a vault. Accepts a file path, full UUID, or UUID prefix. Verifies the Ed25519 signature before accepting. After acceptance, Sigyn prints next steps (sync pull, test access).

# By file path
sigyn delegation accept ./invitation-abc123.json

# By UUID (from 'sigyn delegation pending')
sigyn delegation accept 3a03a59b-114e-444c-a346-6ff33566aa71

# By UUID prefix (shortest unambiguous match)
sigyn delegation accept 3a03a59b

delegation revoke

Revoke one or more members’ access. Environment keys are rotated on revoke.

sigyn delegation revoke a1b2c3d4e5f6...
sigyn delegation revoke a1b2c3d4 b5c6d7e8 f9a0b1c2 --cascade

With --cascade, performs BFS traversal of the delegation tree and revokes the target plus everyone they transitively invited. See Delegation for details.

delegation grant-env

Grant one or more members access to an additional environment.

sigyn delegation grant-env a1b2c3d4 --env prod
sigyn delegation grant-env a1b2c3d4 b5c6d7e8 --env staging

delegation revoke-env

Revoke one or more members’ access to a specific environment. The environment key is rotated.

sigyn delegation revoke-env a1b2c3d4 --env prod
sigyn delegation revoke-env a1b2c3d4 b5c6d7e8 --env staging

delegation pending

List pending invitations.

sigyn delegation pending

delegation bulk-invite

Invite multiple members at once from a JSON file. All entries are validated before any mutations are applied (all-or-nothing validation). Header and policy are saved once at the end.

sigyn delegation bulk-invite --file members.json
sigyn delegation bulk-invite --file members.json --force

File format (JSON array):

[
  {"fingerprint": "a1b2c3d4e5f6...", "role": "contributor", "envs": "dev,staging"},
  {"fingerprint": "f7e8d9c0b1a2...", "role": "readonly", "envs": "*"}
]

Each entry supports fingerprint (required), role (default: readonly), and envs (default: *).

delegation bulk-revoke

Revoke multiple members at once from a JSON file. Delegates to the standard revoke logic, including environment key rotation and optional cascade.

sigyn delegation bulk-revoke --file revoke-list.json
sigyn delegation bulk-revoke --file revoke-list.json --cascade --force

File format (JSON array of fingerprint strings):

["a1b2c3d4e5f6...", "f7e8d9c0b1a2..."]

audit

View and verify the hash-chained audit trail.

audit tail

Show the most recent audit entries.

sigyn audit tail
sigyn audit tail -n 50
sigyn audit tail --vault myapp --json

audit query

Search the audit log with filters.

sigyn audit query --actor a1b2c3d4...
sigyn audit query --env prod
sigyn audit query --actor a1b2c3d4... --env dev

audit verify

Verify the integrity of the hash chain. Reports the first broken entry if tampering is detected, and also checks for tail truncation against a device-local audit tip.

Exit status: returns non-zero when the chain is broken, a signature is invalid, or the log has been truncated — so it is safe to gate on, e.g. sigyn audit verify && deploy. Entries whose signing key is not available locally are reported as a warning and do not cause a non-zero exit.

sigyn audit verify
sigyn audit verify --vault myapp

audit export

Export the full audit log to a file.

sigyn audit export --output audit.json --format json
sigyn audit export --output audit.csv --format csv

audit witness

Countersign the latest audit entry with your Ed25519 key. Provides independent verification that a second party observed the entry.

sigyn audit witness
sigyn audit witness --vault myapp

audit anchor

Anchor the audit trail to a git commit for tamper-evidence.

sigyn audit anchor -v myapp

sync (alias: sy)

Synchronize vaults via git. All data is encrypted at rest; sync never needs the master key.

sync push

Push local vault changes to a remote repository.

sigyn sync push
sigyn sync push --remote origin --branch main

sync pull

Pull remote changes into the local vault.

sigyn sync pull
sigyn sync pull --remote origin --branch main

sync status

Show sync status (clean, local changes, ahead/behind remote).

sigyn sync status
sigyn sync status --vault myapp

sync resolve

Resolve a sync conflict for a specific key.

sigyn sync resolve DATABASE_URL --strategy local
sigyn sync resolve API_KEY --strategy remote
sigyn sync resolve CONFIG --strategy latest

sync configure

Configure sync settings for a vault.

sigyn sync configure --remote-url [email protected]:team/secrets.git
sigyn sync configure --auto-sync true

sync deploy-key generate

Generate a sealed SSH deploy key for audit push. The key is encrypted with the vault cipher and stored in the vault directory. Requires ManagePolicy access.

sigyn sync deploy-key generate

Prints the public key — add it as a deploy key with push access on your git remote.

sync deploy-key show-pubkey

Show the public key of the vault’s deploy key.

sigyn sync deploy-key show-pubkey

sync deploy-key remove

Remove the vault’s deploy key.

sigyn sync deploy-key remove

fork (alias: f)

Manage vault forks for isolated workstreams.

fork create

Create a fork of the current vault.

sigyn fork create feature-branch
sigyn fork create sandbox --mode unleashed
sigyn fork create sprint-3 --mode leashed --expires-days 30

fork list

List all forks for a vault.

sigyn fork list

fork sync

Sync a leashed fork with its parent vault.

sigyn fork sync feature-branch

fork approve

Approve pending changes from a fork back to the parent.

sigyn fork approve feature-branch

fork expire

Manually expire a fork.

sigyn fork expire feature-branch

fork status

Show the status of a specific fork.

sigyn fork status feature-branch

project

Manage project-level configuration.

project init

Generate a .sigyn.toml in the current directory. Interactively prompts to select a vault and identity from those available on the machine. Sigyn auto-detects the project type from package.json, Cargo.toml, pyproject.toml, or go.mod and pre-selects a matching vault if one exists.

sigyn project init                          # interactive (with auto-detection)
sigyn project init -v myapp -i alice        # non-interactive
sigyn project init --global                 # write to ~/.sigyn/project.toml instead

context (alias: ctx)

Manage a persistent context that sets default vault and environment. Stored at ~/.sigyn/context.toml. Context sits between CLI flags and .sigyn.toml in the resolution chain.

context set

Set the active context.

sigyn context set myapp          # set vault only
sigyn context set myapp prod     # set vault and env
sigyn ctx set myapp dev          # using alias

context show

Show the current context.

sigyn context show
sigyn ctx show --json

context clear

Clear the current context.

sigyn context clear

run (alias: r)

Run processes with injected secrets or export secrets in various formats.

The exec subcommand is the default – you can omit it:

# These are equivalent:
sigyn run -- ./my-app
sigyn run exec -- ./my-app

If no vault is configured (no --vault, no .sigyn.toml, no default), Sigyn will detect the project type and offer to create a .sigyn.toml interactively. In non-interactive environments (CI, piped output), it prints an actionable error instead.

Use --dry-run to preview what would happen without executing:

sigyn run --dry-run -e prod -- ./my-app
# [dry-run] Vault: 'myapp', env: 'prod', secrets: 12
# [dry-run] Command: ./my-app
# [dry-run] Clean env: no (inheriting parent)

run (exec)

Execute a command with secrets injected as environment variables. Secrets are never written to disk in plaintext.

sigyn run -e dev -- ./my-app
sigyn run --prod -- docker compose up
sigyn run -e dev -c -- node server.js

Inline Secret Refs

You can reference secrets directly in command arguments using {{KEY}} syntax. The values are substituted before the command is executed:

sigyn run -e prod -- curl -H "Authorization: Bearer {{API_KEY}}" https://api.example.com
sigyn run -e dev -- psql "{{DATABASE_URL}}"

Unresolved refs (keys not found in the environment) are left as-is.

Named commands

If a .sigyn.toml is present with a [commands] table, you can run named commands:

# .sigyn.toml
[commands]
dev = "npm run dev"
app = "./my-app"

sigyn run dev              # runs 'npm run dev' with secrets injected
sigyn run app --prod       # runs './my-app' with prod env secrets

run export

Export secrets in a specified format to stdout.

sigyn run export --env dev --format dotenv > .env
sigyn run export --env dev --format json
sigyn run export --env prod --format k8s --name my-app-secrets
sigyn run export --env dev --format docker
sigyn run export --env dev --format shell

run serve

Serve secrets over a Unix domain socket for local process consumption.

sigyn run serve --env dev
sigyn run serve --env dev --socket /tmp/my-app.sock

watch

Watch for secret changes and automatically restart a command. Polls the encrypted environment file for modifications and restarts the child process when changes are detected.

sigyn watch -- npm run dev
sigyn watch -e staging --interval 5 -- ./my-app
sigyn watch --clean -- node server.js

Uses the global --env / -e flag for environment selection. If the child process exits on its own, watch exits with the same code (does not restart).

rotate (alias: rot)

Manage secret rotation and lifecycle.

rotate key

Rotate a specific secret by generating a new random value.

sigyn rotate key DATABASE_PASSWORD --env prod
sigyn rotate key API_KEY --env dev

rotate schedule list

List all rotation schedules.

sigyn rotate schedule list -v myapp

rotate schedule set

Set a rotation schedule for a key.

sigyn rotate schedule set -v myapp --key DB_PASSWORD --cron "0 0 * * MON" --grace-hours 48

Options:

• --key — Secret key name
• --cron — Cron expression for schedule
• --grace-hours — Grace period in hours (default: 24)
• --hooks — Post-rotation hooks (comma-separated)

rotate schedule remove

Remove a rotation schedule.

sigyn rotate schedule remove -v myapp --key DB_PASSWORD

rotate due

List secrets that are due for rotation based on age.

sigyn rotate due --env dev
sigyn rotate due --env prod --max-age 30

rotate breach-mode

Activate breach mode: rotate all secrets across all environments and revoke all delegated members. Requires confirmation unless --force is set.

sigyn rotate breach-mode
sigyn rotate breach-mode --force

rotate dead-check

Find unused or stale secrets that may be candidates for removal.

sigyn rotate dead-check --env dev
sigyn rotate dead-check --env prod --max-age 365

import (alias: imp)

Import secrets from external files and cloud providers.

import dotenv

Import key-value pairs from a .env file.

sigyn import dotenv .env --env dev
sigyn import dotenv /path/to/production.env --env prod

import json

Import key-value pairs from a JSON file (expects a flat object with string values).

sigyn import json secrets.json --env dev

import doppler

Import secrets from Doppler.

sigyn import doppler --project myapp --config dev --env dev

import aws

Import a secret from AWS Secrets Manager.

sigyn import aws --secret-id myapp/db-credentials --env prod
sigyn import aws --secret-id arn:aws:secretsmanager:... --region us-east-1 --env prod

import gcp

Import a secret from GCP Secret Manager.

sigyn import gcp --project my-gcp-project --secret db-password --env prod
sigyn import gcp --project my-gcp-project --secret api-key --version 3 --env prod

import 1password (alias: op)

Import secrets from 1Password via the op CLI.

sigyn import 1password --vault "Dev Secrets" --item "API Keys" --env dev
sigyn import op --vault Production --item "Database Creds" --env prod

org

Manage hierarchical organizations. See Organizations for the full design document.

org create

Create a root organization. The caller becomes the owner.

sigyn org create acme

Creates ~/.sigyn/orgs/acme/ with node.toml, members.cbor, and policy.cbor.

org node create

Add a child node to an existing org path.

sigyn org node create platform --parent acme --type division
sigyn org node create web --parent acme/platform --type team

org node remove

Remove an empty node (no children, no linked vaults).

sigyn org node remove acme/platform/web

org tree

Display the hierarchy tree.

sigyn org tree
sigyn org tree --org acme

org info

Show node metadata (UUID, type, owner, children, linked vaults, git remote).

sigyn org info acme/platform/web

org policy show

Display the RBAC policy at a hierarchy node.

sigyn org policy show --path acme

org policy member-add

Add a member at a hierarchy level. Permissions cascade to child nodes via inheritance.

sigyn org policy member-add <fingerprint> --role admin --path acme

org policy member-remove

Remove a member from a hierarchy level.

sigyn org policy member-remove <fingerprint> --path acme

org policy effective

Show the merged effective permissions for a member by walking the chain from the target node to the root org.

sigyn org policy effective <fingerprint> --path acme/platform/web

org sync configure

Set the git remote for a hierarchy node. Child nodes without an explicit remote inherit from the nearest ancestor.

sigyn org sync configure --path acme --remote-url [email protected]:acme/secrets.git
sigyn org sync configure --path acme/platform/web --remote-url [email protected]:acme/web.git --branch develop

recovery

Disaster recovery via the standalone sigyn-recovery binary.

recovery split

Split an identity’s private key into Shamir shards.

sigyn-recovery split --identity alice --threshold 3 --total 5
sigyn-recovery split --identity alice --threshold 2 --total 3 --output ./shards

recovery restore

Reconstruct an identity from Shamir shards.

sigyn-recovery restore shard-a1b2c3d4-1.json shard-a1b2c3d4-2.json shard-a1b2c3d4-3.json
sigyn-recovery restore shard-*.json --output recovered_key.bin

recovery print-shards

Print shard details for labeling paper backups.

sigyn-recovery print-shards shard-a1b2c3d4-*.json

recovery snapshots

List available vault snapshots from git history.

sigyn-recovery snapshots --vault myapp

agent

Manage the passphrase agent — an ssh-agent style daemon that caches decrypted keys in memory, eliminating repeated passphrase prompts when running multiple commands.

agent start

Start the agent daemon in the background.

eval $(sigyn agent start)
eval $(sigyn agent start --timeout 60)   # 60-minute cache

Prints a shell-eval-able export statement for SIGYN_AGENT_SOCK. The agent forks to background and listens on a Unix socket with owner-only permissions (0600).

agent stop

Stop the agent daemon and zeroize all cached keys.

sigyn agent stop

agent lock

Clear all cached keys but keep the daemon running.

sigyn agent lock

agent status

Show whether the agent is running and how many keys are cached.

sigyn agent status

Utility Commands

web

Launch the local web GUI in your browser. Requires building with --features web.

sigyn web                          # http://127.0.0.1:9847
sigyn web --port 8080              # custom port
sigyn web --open                   # auto-open browser
sigyn web --timeout 60             # 60-minute session timeout

The web GUI binds exclusively to 127.0.0.1 (localhost) and is never accessible remotely. See the Web GUI page for details.

tui

Launch the interactive TUI dashboard (built with ratatui + crossterm).

sigyn tui
sigyn tui --vault myapp --env dev

doctor

Run health checks on the Sigyn installation. Checks include: home directory, identities, vaults, config file, .sigyn.toml in the current directory tree, default vault accessibility, git availability, pending invitations, and project type detection.

sigyn doctor

onboard

Guided first-run setup wizard. Walks through identity creation, vault creation, .env file import, and .sigyn.toml setup. In non-interactive mode, prints a checklist of what’s missing.

sigyn onboard
sigyn onboard --json   # report setup status as JSON

status

Show current configuration status including identity, vault, environments, sync status, rotation schedules, and pending invitations.

sigyn status
sigyn status --json

init

Initialize the default configuration file at ~/.sigyn/config.toml. In interactive mode, offers to create an identity and vault if none exist, then runs doctor checks.

sigyn init
sigyn init --identity alice --vault myapp

notification configure

Interactively configure a webhook for receiving notifications about vault events. Webhook URLs must use HTTPS (HTTP is only allowed for localhost). If a shared secret is provided, requests include an X-Sigyn-Signature HMAC header for verification.

sigyn notification configure

notification test

Send a test notification to all configured webhooks.

sigyn notification test
sigyn notification test --json

notification list

List all configured webhook endpoints and their event filters.

sigyn notification list
sigyn notification list --json

update

Self-update to the latest release. Downloads the appropriate binary for the current platform and verifies the SHA-256 checksum before replacing the running binary. The update will abort if the checksum file cannot be downloaded or verification fails.

Security hardening: HTTP requests have connect (10s) and total (120s) timeouts. Archives exceeding 100 MiB are rejected. Tar entries with path traversal (..) are blocked. Temp files use random names to prevent symlink attacks.

sigyn update

completions

Generate shell completion scripts.

sigyn completions bash > ~/.local/share/bash-completion/completions/sigyn
sigyn completions zsh > ~/.zfunc/_sigyn
sigyn completions fish > ~/.config/fish/completions/sigyn.fish
sigyn completions powershell >> $PROFILE

Supported shells: bash, zsh, fish, powershell.

ci

CI/CD integration helpers.

ci setup

Export identity bundle for use in CI/CD pipelines. Outputs the base64-encoded identity file, device key, and fingerprint needed to configure GitHub Actions secrets (or equivalent in other CI systems).

sigyn ci setup              # uses default identity
sigyn ci setup ci-bot       # uses specific identity
sigyn ci setup --json       # machine-readable output

The command outputs a single SIGYN_CI_BUNDLE value (base64-encoded JSON containing identity file, device key, and fingerprint). You also need SIGYN_PASSPHRASE and VAULT_SSH_KEY as separate GitHub secrets — 3 secrets total.

See the CI/CD Integration page for full workflow examples, the GitHub Action reference, and troubleshooting.

Related Documentation

• Getting Started – step-by-step tutorial
• Architecture – project structure and design decisions
• Security Model – cryptographic primitives and threat model
• Organizations – hierarchical org structure and inherited RBAC
• Delegation – invitation and revocation system
• Sync – synchronization and conflict resolution