{{define "developers"}}

Developers

One CLI call. Every secret.

No env vars. No config files. No secrets sprawl. Every secret your infrastructure needs, one CLI call away.

The pattern

Store it once. Retrieve it anywhere.

The CLI is initialized once per machine. After that, any process can fetch secrets at runtime. The key is stored encrypted in the vault, never in env vars or source code. If the key rotates, update it in the vault UI — your services pick it up automatically.

# One-time setup
$ clavitor-cli init <token>
# Retrieve any secret, any time
$ clavitor-cli get "OpenRouter API" --field password
sk-or-v1-abc123...

Languages

Works in every language. No SDK required.

Bash

DB_PASSWORD=$(clavitor-cli get "Production DB" --field password)
API_KEY=$(clavitor-cli get "OpenRouter API" --field password)
SSH_KEY=$(clavitor-cli get "Deploy Key" --field private_key)

Go

key, _ := exec.Command("clavitor-cli", "get", "OpenRouter API", "--field", "password").Output()
db, _ := sql.Open("postgres", fmt.Sprintf("host=db user=app password=%s", strings.TrimSpace(string(key))))

Python

import subprocess
api_key = subprocess.check_output(
    ["clavitor-cli", "get", "Stripe API", "--field", "password"]
).decode().strip()
stripe.api_key = api_key

Rust

let key = std::process::Command::new("clavitor-cli")
    .args(["get", "AWS Credentials", "--field", "password"])
    .output()?.stdout;
std::env::set_var("AWS_SECRET_ACCESS_KEY", String::from_utf8(key)?.trim());

TypeScript / Node

import { execSync } from 'child_process';
const apiKey = execSync('clavitor-cli get "Anthropic API" --field password').toString().trim();
const client = new Anthropic({ apiKey });

Infrastructure

Zero secrets in config.

Docker Compose

services:
  app:
    environment:
      - DB_PASSWORD=$(clavitor-cli get "Production DB" --field password)

Terraform

data "external" "vault" {
  program = ["clavitor-cli", "get", "AWS Root", "--json"]
}
provider "aws" {
  secret_key = data.external.vault.result.password
}

Kubernetes

kubectl create secret generic app-secrets \
  --from-literal=db-pass="$(clavitor-cli get 'Production DB' --field password)" \
  --from-literal=api-key="$(clavitor-cli get 'Stripe API' --field password)"

Ansible

- name: Get database password
  command: clavitor-cli get "Production DB" --field password
  register: db_pass
  no_log: true

- name: Configure app
  template:
    src: app.conf.j2
  vars:
    db_password: "{{"{{"}} db_pass.stdout {{"}}"}}"

GitHub Actions

- run: |
    echo "API_KEY=$(clavitor-cli get 'Deploy Token' --field password)" >> $GITHUB_ENV

SSH with vault-stored keys

eval $(clavitor-cli get "Deploy Key" --field private_key | ssh-add -)
ssh deploy@production

AI agents

Every agent. Scoped access. Audit trail.

Claude Code

# Skill auto-installed on init
clavitor-cli init <token>
clavitor-cli skill > ~/.claude/skills/clavitor.md

# Claude Code can now:
#   "get me the AWS credentials"
#   "what's the GitHub deploy token?"
#   "store this API key as 'Stripe Prod'"

Add to any project's CLAUDE.md: "Use clavitor-cli to retrieve secrets. Never hardcode secrets. Never store them in .env files."

OpenClaw

# Skill auto-installed on init
clavitor-cli init <token>
# OpenClaw agents can now access vault entries within their scope

Codex (OpenAI)

export CODEX_ENV_API_KEY=$(clavitor-cli get "OpenAI API" --field password)
codex --env API_KEY

Cursor / Windsurf / Aider

Any agent that runs shell commands. Add to project instructions:

# "Use clavitor-cli to retrieve secrets. Never ask the user for passwords."

CrewAI / LangChain / AutoGen

import subprocess

def get_secret(name, field="password"):
    return subprocess.check_output(
        ["clavitor-cli", "get", name, "--field", field]
    ).decode().strip()

# As an agent tool
tools = [Tool(
    name="get_credential",
    description="Retrieve a credential from the vault",
    func=lambda q: subprocess.check_output(["clavitor-cli", "get", q]).decode()
)]

n8n / Make / Zapier

curl -H "Authorization: Bearer $CVT_TOKEN" \
  https://vault.example.com/api/entries/search?q=Stripe

The pattern is always the same.

One CLI call, any context. The agent's scope determines what it can see. The tier determines what it can decrypt.

Self-host free → Get hosted →
{{end}}