RDC CLI

The RDC CLI lets you sign in to RDC Cloud and use Envault secrets from your terminal. Use Console to create and edit secrets; use the CLI to configure a local directory, download resolved values, or run an application with its environment populated.

Before you beginCopy Anchor Link

These examples assume the rdc command is installed. Contact support for CLI availability and installation instructions.

Confirm that the command is available:

rdc --version
rdc --help

You need an active RDC Cloud account. Envault access also requires the appropriate workspace permissions. Login does not grant additional permissions.

Sign inCopy Anchor Link

Run the CLI. The RDC Cloud API address is already configured:

rdc login

The CLI displays a verification code and opens the Console in your default browser. Sign in with your existing RDC account, review the device request, and compare the code with your terminal. Only enter the code displayed by an rdc login command you ran yourself. Never use a code sent by someone else. Select Approve only if you started this login. The device name is provided by the CLI and is not verified hardware identity.

Enter or confirm the code, then select Review request. Review the account, device name, and code before selecting Approve or Deny. Signing in alone does not approve the request.

If you need to sign in first, Console returns you to the approval process. You do not need to select a workspace or project.

After approval, wait for the terminal to confirm login. Requests expire after 10 minutes. Select Deny to reject a request.

For an SSH session or a machine without a browser:

rdc login --no-browser

Open the displayed URL on another device and enter the code in the eight character fields, grouped four and four. You can paste the full code including its hyphen; lowercase letters are converted to uppercase. Use --device-name "Work laptop" to choose the name displayed in the approval page and token list.

Check the account and sign outCopy Anchor Link

rdc whoami
rdc logout

Without RDC_TOKEN, logout revokes the saved token on the server before removing local credentials. If the network request fails, credentials remain so you can retry. An already expired or revoked token can be removed locally by running logout again. Run logout before replacing an existing login.

Browser-issued CLI tokens expire after 30 days; automatic refresh is not provided. They act with the account's current RDC permissions, including any services accepting personal access tokens. Run login again after expiry. Changing a user's permissions changes what the token can do; disabling the account blocks access.

Manage device tokensCopy Anchor Link

Open the account menu → Access Token in Console. CLI logins appear as CLI device, alongside manually created personal tokens. Each entry shows the device name, the issuing client’s User-Agent, creation date, most recent API use, expiry, and current status. A login creates a separate entry, even when it uses the same device name.

Select Revoke on the device entry and confirm. Subsequent authenticated requests using that token are rejected; requests already in progress are not cancelled. Other device logins remain active.

Local credentialsCopy Anchor Link

The CLI stores login tokens in your operating system's secure credential store: macOS Keychain, Windows Credential Manager, or an unlocked Secret Service provider on Linux. The files under ~/.rdc/ contain login references and directory-specific Envault selections. Do not share this directory or commit it to version control.

If the store is locked or unavailable, unlock it and retry; the CLI does not switch to plaintext storage. Moving the configuration directory requires logging in again.

The RDC Cloud API address is already configured for browser login. Run rdc logout to revoke the saved login and remove its local credentials; directory selections remain available.

Machines without a browserCopy Anchor Link

Use rdc login --no-browser and approve from another device. The machine running RDC still needs an available, unlocked OS credential store for this login method.

CI and containersCopy Anchor Link

Create an access token from Access Token in Console and inject it as the RDC_TOKEN secret environment variable in your CI job or container. No rdc login or OS credential store is required. With the variable already injected:

rdc whoami
rdc secret runtime --workspace <workspace-uuid> --group backend --environment production -- node server.js

RDC_TOKEN takes precedence over any saved login and is never saved by the CLI. It uses the default RDC API; a different --api-url is rejected. An empty, invalid, expired or revoked token fails without switching to your saved account. The token's permissions, expiry and Envault IP policies still apply.

rdc logout with this variable set revokes the supplied token and leaves your saved login intact. Remove the variable from your shell or CI configuration after logout; the CLI cannot change its parent environment. Unset it before running rdc login or returning to a saved login. Avoid revoking a shared CI token at the end of every job if other jobs still need it.

secret runtime excludes the reserved RDC_TOKEN variable from the child process, even if a delivered Envault secret uses that name. Use another name for application data. Downloads retain their normal secret output. Keep authentication tokens in your CI secret store and out of command output or shell tracing.

TroubleshootingCopy Anchor Link

• If the CLI reports invalid or unsupported credential metadata, revoke the previous CLI session through Access Token in Console, remove only ~/.rdc/credentials.json, and run rdc login. Directory selections remain intact. Older plaintext credentials are not automatically migrated.

• If the OS vault cannot be accessed, unlock your credential store. Linux requires an available Secret Service provider, including when using --no-browser.

• If file access fails, check permissions on ~/.rdc and retry after other RDC commands finish.

• If a code expires or has already been used, start login again.

• If requests are rate limited, wait and retry.

• If login is denied, check the selected account and start a new request.

• If Console says account approval is pending, an administrator must activate your account before you can approve a CLI login.

• If the terminal does not confirm login after approval, inspect Access Token for an unused device token and revoke it before retrying.

The displayed User-Agent describes the client used to create the token. It may be unavailable for older tokens and is not a verified device identity. Revoke any token you do not recognize.

Next stepsCopy Anchor Link

• Envault: CLI configuration, download and runtime explains how to select secrets and use them locally.
• CLI command reference lists supported commands and flags.

Resource guides keep Console and CLI instructions together where both are supported. The CLI currently supports account access and Envault configuration/export/runtime; use Console for resource provisioning and secret creation, editing and import.