Authentication

The CLI supports two authentication modes: interactive login for local development and CI tokens for automated pipelines. When DEPVAULT_TOKEN is set in the environment, the CLI uses it automatically and blocks interactive commands.

depvault login

Authenticate with your DepVault account using a browser-based device flow. Running depvault login prints a short verification code, opens your browser to confirm it, and — once you approve — stores JWT tokens in ~/.depvault/credentials.json.

depvault login

# Connect to a self-hosted instance
depvault login --server https://api.example.com

Because login opens a browser, it requires an interactive terminal. In CI/CD, do not run depvault login — set DEPVAULT_TOKEN instead (see below).

Blocked when DEPVAULT_TOKEN is set to prevent credential conflicts.

Prerequisite: create your account and set up your encryption vault in the web dashboard before using the CLI. The CLI cannot register an account or initialize a vault — push and pull fail with Vault not initialized until vault setup is complete.

depvault logout

Deletes ~/.depvault/credentials.json. You must run depvault login again to re-authenticate.

depvault logout

depvault whoami

Shows the current authentication state.

depvault whoami

• Interactive mode — Displays your email, name, and authentication method.
• CI token mode — Reports that authentication comes from DEPVAULT_TOKEN.
• Not authenticated — Prompts to log in or set DEPVAULT_TOKEN.

CI Token Mode

For CI/CD pipelines, use a project-scoped token instead of interactive login. See the CI/CD Integration guide for token generation, scoping, and pipeline examples.

export DEPVAULT_TOKEN=dvci_xxxxxxxx.xxxxxxxxxxxxxxxx
depvault ci pull

Credential Storage

Never commit these files to version control.