Command line

lasbolt is the command line client. It works on macOS, Linux and Windows. It keeps a local copy of your vault, and it syncs with your server.

This page shows the common tasks. The lasbolt reference lists each command and flag.

Set up

lasbolt login https://vault.example.org

lasbolt login --password --user alice https://vault.example.org

lasbolt status

lasbolt unlock

The agent

The first command starts a small background program, the agent. It holds the keys and the local copy of the vault. The browser extension and the apps use the same agent. It stops after 24 hours, or when you run lasbolt agent stop. Run lasbolt agent status to see it.

To work without the agent, set LASBOLT_AGENT=off or use --no-agent. E2E folders then stay locked.

Find items

A reference is the path of an item and a field. lasbolt ls shows the tree.

lasbolt ls
lasbolt ls Personal/Work/APIs
lasbolt search github

search finds names, usernames and URLs. It never shows a secret.

show prints an item. It hides secret fields.

lasbolt show "Personal/GitHub (renamed)"

You can use these forms of a reference:

Add --json to any command to get JSON.

Read a value

read prints one value and nothing else.

lasbolt read "Personal/Work/APIs/OpenWeather/password"

To copy a value, use -n (no newline) and the tool of your system:

lasbolt read -n "Personal/Work/APIs/OpenWeather/password" | pbcopy

lasbolt has no copy command and no timer that clears the clipboard. The apps and the extension clear it after 30 seconds.

--purpose "text" adds a reason to the audit log of the read.

Use secrets in programs

run starts a program with secrets in its environment. The secrets never go to a file.

lasbolt run --env API_KEY=lasbolt://Personal/Work/APIs/OpenWeather/password -- ./deploy.sh

inject fills a template. Each {{ lasbolt://... }} is replaced by its value.

printf 'key={{ lasbolt://Personal/Work/APIs/OpenWeather/password }}\n' > app.tpl
lasbolt inject -i app.tpl -o app.env

-o writes the file with mode 0600. Without -o, inject prints to the terminal.

Make and change items

lasbolt new login "Personal/Docs test" --set username=me@example.org --set url=https://example.org/login --stdin password
lasbolt edit "Personal/Docs test" --set username=you@example.org
lasbolt rm "Personal/Docs test"

--stdin password reads the value of the field from the standard input, so it is not in the process list. rm moves the item to the trash. new --if-missing succeeds when the item exists. Your login needs write access for these commands.

To move a whole vault in, see Import from Bitwarden.

Scripts and exit codes

Each command ends with a code. A script can test it.

See Exit codes for the full list.

if ! pw=$(lasbolt read -n Personal/Work/APIs/OpenWeather/password); then
  echo "no password: exit $?" >&2
  exit 1
fi

Keys for scripts and agents

A scoped key lets a CI job or an AI agent read a few items without your session. It has its own access, folders and end date. To make a key, sign in with --password and run lasbolt unlock first. The command needs your user keys.

lasbolt keys create ci-read --access read --folder Personal/Work/APIs --expires 30d

The command prints the key one time. The server does not keep it. The key starts with lasbolt_sk_. Store it in the secret store of your CI.

A program uses the key with two variables. It keeps nothing on disk.

export LASBOLT_SERVER=https://vault.example.org
export LASBOLT_KEY=lasbolt_sk_...
lasbolt read Personal/Work/APIs/OpenWeather/password

Use lasbolt keys list to see the keys and lasbolt keys revoke <ID> to end one. A key with --access read that tries to change an item gets exit code 4. Revoking a key also removes its token on the server.

For AI agents, lasbolt mcp starts an MCP server on stdio. See AI agents.

Environment variables

More

• The lasbolt reference: every command and flag.
• Devices and approvals
• Peer sync: the agent can sync with your other devices.