Getting started

The OneGuard CLI pulls your encrypted environment variables into a local .env file, pushes changes back, and manages vaults, secrets and team members — without leaving your terminal.

Install

macOS and Linux

OneGuard publishes from its own Homebrew repository (a "tap"), so you point Homebrew at it once:

brew tap oneguard-sa/oneguard
brew install oneguard

Or in a single command, which taps and installs together:

brew install oneguard-sa/oneguard/oneguard

Check it worked:

oneguard --help
which oneguard

Windows

Chocolatey support is in progress:

choco install oneguard

Sign in

Generate an API key from the OneGuard dashboard — Vault → API Keys → Add — choose a permission and an expiry, then copy the key. It starts with og_ and is shown only once.

oneguard auth login og_your_key

The key is stored in ~/.oneguard/credentials.json, readable only by your user. To sign out:

oneguard auth logout

Key permissions

A key is created as either read or write, and the server enforces the difference:

| Permission | Can do | | --- | --- | | read | status, vault list, secrets list, env pull, env sync, teams list, logs list, and generate (which never leaves your machine) | | write | all of the above, plus creating, editing, archiving and deleting secrets and vaults, env sync --push, secrets generate, and inviting or removing members |

A read-only key used for a write is refused with a clear message. It does not sign you out — your session stays valid, you simply need a key with write permission for that action.

To see what the key you are currently using can do:

oneguard status

Upgrading

brew update
brew upgrade oneguard

To see what you are running against what is available:

oneguard --help
brew info oneguard

If brew upgrade reports nothing to do but you expect a newer version, Homebrew's copy of the tap may be stale — brew update refreshes it. To force a clean reinstall:

brew uninstall oneguard && brew install oneguard-sa/oneguard/oneguard

Running a local build

When you are working on the CLI itself, you can run your build without disturbing the installed one. Do not put it on PATH:

cd oneguard_cli
dart compile exe bin/oneguard.dart -o build/oneguard
./build/oneguard vault list

The CLI stores its key in $HOME/.oneguard/credentials.json — one file shared by every copy on the machine. To keep a test login separate, give it a different home:

HOME=/tmp/oneguard-dev ./build/oneguard auth login og_test_key
HOME=/tmp/oneguard-dev ./build/oneguard status

Everything the CLI stores then lives under /tmp/oneguard-dev/.oneguard/, and your real session is untouched.