💻 CLI Reference

Command-line interface for managing AVP credentials

Installation

pip install avp-cli

Global Options

These options are available for all commands:

--vault, -v     Path to vault file (default: ~/.avp/vault.enc)
--password, -p  Vault password (will prompt if not provided)
--workspace, -w Workspace name (default: "default")
--help          Show help message

Commands

avp init

Initialize a new AVP vault.

# Interactive (prompts for password)
avp init

# With specific path
avp init --vault ~/my-vault.enc

# With password (not recommended for security)
avp init --password "secure-password"

avp store <key> <value>

Store a credential in the vault.

# Store an API key
avp store openai_api_key "sk-..."

# Store in specific workspace
avp store db_password "secret" --workspace production

# Password will be prompted
Password:

avp get <key>

Retrieve a credential from the vault.

# Get a credential
avp get openai_api_key
openai_api_key: sk-...

# Quiet mode (only value, great for scripts)
avp get openai_api_key --quiet
sk-...

# Use in shell scripts
export OPENAI_API_KEY=$(avp get openai_api_key -q)

avp list

List all credentials in a workspace.

avp list

┌────────────────────┬─────────┬────────────┐
│ Key                │ Version │ Created    │
├────────────────────┼─────────┼────────────┤
│ openai_api_key     │ 2       │ 2024-02-18 │
│ anthropic_api_key  │ 1       │ 2024-02-17 │
│ db_password        │ 3       │ 2024-02-15 │
└────────────────────┴─────────┴────────────┘

avp delete <key>

Delete a credential from the vault.

# Delete with confirmation
avp delete old_api_key
Delete credential 'old_api_key'? [y/N]: y
✓ Deleted credential: old_api_key

# Force delete (no confirmation)
avp delete old_api_key --force

avp rotate <key> <new_value>

Rotate a credential with version tracking.

avp rotate openai_api_key "sk-new-..."
✓ Rotated credential: openai_api_key

avp info

Show vault information.

avp info

╭──────────────────────────────────────────╮
│              AVP Vault Info              │
├──────────────────────────────────────────┤
│ Vault Path: /Users/you/.avp/vault.enc    │
│ Size: 4.2 KB                             │
│ Credentials: 12                          │
╰──────────────────────────────────────────╯

avp import <source>

Import credentials from a file.

# From JSON
avp import secrets.json --format json

# From .env file
avp import .env --format dotenv

# Import to specific workspace
avp import prod.json --workspace production

avp export <destination>

Export credentials to a file.

# Export to JSON
avp export backup.json --format json

# Export to .env format
avp export .env --format dotenv

⚠️ Warning: Exported files contain sensitive data in plaintext. Handle with care!

Environment Variables

AVP_VAULT       Path to vault file
AVP_PASSWORD    Vault password (use with caution)
AVP_WORKSPACE   Default workspace

Examples

Basic Workflow

# Initialize vault
avp init

# Store credentials
avp store openai_api_key "sk-..."
avp store anthropic_api_key "sk-ant-..."

# List all credentials
avp list

# Use in your application
export OPENAI_API_KEY=$(avp get openai_api_key -q)
python my_agent.py

Multiple Workspaces

# Development workspace
avp store api_key "dev-key" --workspace dev

# Production workspace
avp store api_key "prod-key" --workspace prod

# Switch between them
avp get api_key --workspace dev   # dev-key
avp get api_key --workspace prod  # prod-key

CI/CD Integration

# In your CI pipeline
- name: Setup AVP
  run: |
    pip install avp-cli
    echo "${{ secrets.AVP_PASSWORD }}" | avp get db_password -q > /tmp/db_pass

- name: Run tests
  env:
    DB_PASSWORD: $(cat /tmp/db_pass)
  run: pytest