CLI command reference
Supported RDC CLI commands, directory selections, and output options.
Start with RDC CLI for availability and browser login. Follow the Envault guide for a complete workflow. The default API address is already configured.
Run rdc secret --help to browse Envault commands, or rdc secret download --help
for options specific to downloading. Help does not require login.
Account commands
| Command | Purpose |
|---|---|
rdc login | Start browser approval and save a device login. |
rdc login --no-browser | Print the approval URL without opening a browser. |
rdc login --device-name "Work laptop" | Label the device request. |
rdc whoami | Check the current authenticated account. |
rdc logout | Revoke the active token; remove saved credentials only when a saved login was used. |
rdc --help | Show available commands and options. |
rdc --version | Show the installed version. |
Sign out before replacing an existing login. Directory selections are retained on logout; another account still needs permission to access the selected workspace.
For CI, inject RDC_TOKEN to authenticate without login or an OS vault. It takes
precedence over saved credentials and uses the default RDC API only. Unset it
before browser login. See CI and containers
for token lifecycle and storage guidance.
Configure a directory
rdc secret configureSelect an accessible workspace, application group, and environment from the prompts.
Run this in the directory where you start your application. Selections are saved
under ~/.rdc/envault/, not in the project repository. Subdirectories inherit the
nearest configured parent; a more specific selection takes precedence.
For a non-interactive selection, supply all three identifiers:
rdc secret configure --workspace <workspace-uuid> --group backend --environment develop--group is the Envault application group name, not an RDC infrastructure Project ID.
Configuration stores selection metadata, not secret values. Run configure again
to change the saved selection.
Download values
rdc secret download
rdc secret download --format json --output secrets.json
rdc secret download --environment production --output .env.production| Option | Behavior |
|---|---|
--workspace <uuid> | Override the selected workspace for this invocation. |
--group <name> | Override the selected application group. |
--environment <name> | Override the selected environment. |
--format dotenv or --format json | Choose the output format; dotenv is the default. |
--output <path> | Select a file; the default is .env for dotenv or secrets.json for JSON. |
--stdout | Write secret values to standard output instead of a file. Do not combine with --output or --force. |
--force | Allow replacement of an existing output file. |
Downloads resolve Application values, Workspace defaults and Shared references. Direct Shared or Workspace exports are not supported. One-off selection flags do not rewrite the saved directory configuration. Treat exported files and stdout as secret data and keep them out of version control and build logs.
Run with secrets
rdc secret runtime -- npm run dev
rdc secret runtime --environment production -- node server.jsThe command after -- receives resolved secrets as environment variables without
creating a file. Envault values override local variables with the same names.
The reserved RDC_TOKEN variable is excluded from the child environment, including
an Envault secret with that name.
Workspace, group and environment flags work as for download; output-format and
file-output flags do not apply to runtime.
The child command is executed directly, so shell operators such as | and > are
not interpreted. The child keeps its standard streams and exit status. Interrupting
the CLI stops the managed child processes; an independently detached process is
outside that lifecycle. No secrets are cached for offline use.
Shell completions
rdc completion bash
rdc completion zsh
rdc completion fishEach command prints the corresponding completion script. Load it using your
shell's completion setup. rdc secrets and rdc envault are aliases for rdc secret.
Automatic environment metadata
Every successful rdc secret runtime and rdc secret download receives these values from Envault:
| Variable | Value |
|---|---|
ENVAULT_GROUP | The selected Secret Group name, such as backend |
ENVAULT_ENVIRONMENT | The selected environment name, such as production |
These values follow the effective selection, including --group and --environment overrides. They are included even when the environment has no stored secrets, and appear in both dotenv and JSON downloads, whether written to a file or stdout.
These two names are reserved delivery metadata. Envault supplies these values during delivery, replacing identically named secrets. CLI runtime also overrides matching variables inherited from your shell. Stored secrets are not modified. The variables describe the selection; setting them in your shell does not change which environment the CLI fetches.
For example, rdc secret runtime --group backend --environment production -- npm run dev starts your application with ENVAULT_GROUP=backend and ENVAULT_ENVIRONMENT=production alongside its secrets.