Skip to content
Docs

Command reference

There are two programs. ku (also installed as kuukura) is the CLI for people and CI. ku-server is the server and the operator’s tool on the host. Both print this list with help; the tables below are read from their source when the site is built.

Start here: add your server with ku profile add, sign in with ku login, save a value with ku secret set, then start your app with ku run. Jump to a group: profile · secret · run · workspace · account · key · user · audit.

ku

Section titled “ku”

Commands that talk to a server take --profile <name>.

A typical session:

Terminal window
ku profile add work --url https://vault.example.com   # the profile holds the server URL
ku login                                              # Google, then your passkey or authenticator app
ku secret set DATABASE_URL app:shop                   # the value comes from a hidden prompt
ku link shop                                          # this folder belongs to the "shop" app
ku run env:dev -- npm run dev                         # the command starts with its secrets in the environment

Values are never arguments, stdout carries only data, and ku run refuses secret names that load code. The details are in What goes where and the exit codes in Errors and exit codes. Passkeys and authenticator apps: Your passkeys and authenticator apps.

Command What it does
login sign in to the active server
link [<app>] link this folder to an app
version, --version print the version

profile

Section titled “profile”
Command What it does
profile add <name> --url <url> add a server (start here)
profile use <name> switch the active server
profile list list servers
profile remove <name> forget a server and its session

secret

Section titled “secret”
Command What it does
secret list [name] [tags] list secrets, never their values
secret set <name> [tags] save a value
secret get <name> [tags] reveal a value (–reveal or –out)
secret update <name|tags> [+tag -tag] rename, retag or change confirmation
secret revoke <name|tags> block a secret until a new value is saved
secret archive <name|tags> hide a secret

run

Section titled “run”
Command What it does
run [name] [tags] -- <command> run a command with secrets

workspace

Section titled “workspace”
Command What it does
workspace invite <email> invite a person (–machine for CI)
workspace group <group> +id -id change group members
workspace grant <who> <read|write> <tags> give access to secrets with these tags
workspace ungrant <who> <tags> take it away
workspace disable <identity> block a person or machine
workspace enable <identity> lift the block
workspace audit [name] [tags] show who did what

account

Section titled “account”
Command What it does
account factor list list your passkeys and authenticator apps
account factor add <passkey|totp> add one
account factor default <id> offer it first
account factor remove <id> remove one

ku-server

Section titled “ku-server”
Command What it does
serve start the server
healthcheck check the running server (for the container)
version print the version

key

Section titled “key”
Command What it does
key init [--key-file <path>] write a new master key file
key rotate [--rewrap-only] add a key version and rewrap every secret
key show show the master key once, to back it up

user

Section titled “user”
Command What it does
user list list people and machines
user invite <email> [--admin] print a sign-up link
user disable <email|name> block a person or machine
user enable <email|name> lift the block
user reset-factors <email> remove passkeys and apps, print a link

audit

Section titled “audit”
Command What it does
audit verify check the audit log chain

Run it inside the container, for example docker compose exec kuukura /ku-server user list. Every state change is audited under the reserved ku-server principal. See People from the host, the master key and the key rotation drill.