{"id":27768022,"url":"https://github.com/heaths/akv-cli-rs","last_synced_at":"2026-05-02T06:07:15.589Z","repository":{"id":276950869,"uuid":"930759127","full_name":"heaths/akv-cli-rs","owner":"heaths","description":"Azure Key Vault CLI","archived":false,"fork":false,"pushed_at":"2025-10-10T15:57:34.000Z","size":301,"stargazers_count":1,"open_issues_count":4,"forks_count":2,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-10-10T22:58:16.611Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/heaths.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-02-11T06:53:25.000Z","updated_at":"2025-10-10T15:57:38.000Z","dependencies_parsed_at":"2025-02-11T10:39:02.899Z","dependency_job_id":"be34ec27-ca75-43cb-8d32-43a4024eb6b1","html_url":"https://github.com/heaths/akv-cli-rs","commit_stats":null,"previous_names":["heaths/akv-cli-rs"],"tags_count":8,"template":false,"template_full_name":"heaths/template-rustlang","purl":"pkg:github/heaths/akv-cli-rs","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/heaths%2Fakv-cli-rs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/heaths%2Fakv-cli-rs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/heaths%2Fakv-cli-rs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/heaths%2Fakv-cli-rs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/heaths","download_url":"https://codeload.github.com/heaths/akv-cli-rs/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/heaths%2Fakv-cli-rs/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279018131,"owners_count":26086284,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-14T02:00:06.444Z","response_time":60,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-04-29T19:58:59.797Z","updated_at":"2026-05-02T06:07:15.577Z","avatar_url":"https://github.com/heaths.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Azure Key Vault CLI (Unofficial)\n\n[![releases](https://img.shields.io/github/v/release/heaths/akv-cli-rs.svg?logo=github)](https://github.com/heaths/akv-cli-rs/releases/latest)\n[![ci](https://github.com/heaths/akv-cli-rs/actions/workflows/ci.yml/badge.svg?event=push)](https://github.com/heaths/akv-cli-rs/actions/workflows/ci.yml)\n\nThe Azure Key Vault CLI can be used to read and decrypt secrets, pass them securely to other commands, or inject them into configuration files.\n\n## Installation\n\nYou can install prebuilt binaries or build from source.\n\n### Linux and macOS\n\nUse [Homebrew] to install binaries for most macOS and Linux platforms.\nYou first need to install the tap, but only the first time:\n\n```bash\nbrew tap heaths/tap\n```\n\nOnce the tap is installed, you can install or update the `akv` formula:\n\n```bash\nbrew install akv\n```\n\n### Windows\n\nUse [Winget] to install binaries for Windows:\n\n```pwsh\nwinget install heaths.akv\n```\n\n### Build from source\n\nIf you have [Rust] installed, you can also build the CLI on nearly any platform:\n\n```bash\ncargo install --locked akv-cli\n```\n\n## Using\n\nInspired by the [1Password CLI], you can use similar commands to read and decrypt secrets and from [Azure Key Vault].\nThough the crate is named `akv-cli`, note that the actual program is named `akv`.\n\nSome arguments can read environment variables, e.g., `--vault` which reads from `AZURE_KEYVAULT_URL`.\nThis information can be found in `--help` for commands. This makes it easy to pass just the secret name e.g.,\n\n```bash\nexport AZURE_KEYVAULT_URL=https://my-vault.vault.azure.net\n\nakv secret list\nakv read --name my-secret\n```\n\nEnvironment variables can be read from `.env` files created by the [Azure Developer CLI],\nor from any `.env` file found in ancestor directories.\n\n### Injecting secrets\n\nYou can read a templated file or from stdin to inject secrets into the stream.\nAny secret ID e.g., `https://my-vault.vault.azure.net/secrets/my-secret` between `{{ }}` will be replaced, if it exists.\n\n```bash\necho \"my-secret: {{ https://my-vault.vault.azure.net/secrets/my-secret }}\" | akv inject\n```\n\nYou can also read from stdin, or from files using `--in-file` e.g.,\n\n```bash\ncat \u003c\u003c'EOF' | akv inject -o config.json\n{\n    \"token\": \"{{ https://my-vault.vault.azure.net/secrets/my-secret/746984e474594896aad9aff48aca0849 }}\"\n}\nEOF\n```\n\n### Reading a secret\n\nYou can pass secrets to terminal applications, though how exactly depends on your shell. For bash,\n\n```bash\ncargo login $(akv read https://my-vault.vault.azure.net/secrets/my-secret)\n```\n\nNote that secrets in Key Vault are versioned. The example above reads the latest version, but you can also read any version.\nIt's often important to refer to a specific version until you're ready to rotate to a new secret.\n\n```bash\nakv read https://my-vault.vault.azure.net/secrets/my-secret/746984e474594896aad9aff48aca0849\n```\n\n### Passing secrets to new processes\n\nYou can start a process that reads environment variables containing URLs to secrets or compact JSON Web Encryption (JWE) tokens instead of keeping secrets in environment variables that any process can read.\n\nEnvironment variables can contain only a URL to a secret or compact JWE.\nSecrets read or decrypted from Azure Key Vault will be masked in stdout and stderr unless you pass `--no-masking`.\n\n```bash\nexport SECRET_VAR=https://my-vault.vault.azure.net/secrets/my-secret\n\nakv run -- printenv SECRET_VAR\nakv run --no-masking -- printenv SECRET_VAR\n```\n\n### Encrypting and decrypting secrets\n\nYou can encrypt secrets to store as compact JSON Web Encryption (JWE) tokens.\nA content encryption key (CEK) is generated and encrypted (wrapped) by Key Vault.\nThe CEK is used to encrypt your secrets, and the encrypted CEK along with the full key ID including the version\nare encoded within the compact JWE.\n\n```bash\nexport AZURE_KEYVAULT_URL=https://my-vault.vault.azure.net\n\nJWE=$(akv encrypt --name my-key 'plaintext')\nakv decrypt $JWE\n```\n\nIf you do not pass a `--version`, the latest key version is used to encrypt; however,\nthe full key ID including the version used is encoded to make sure that you can decrypt your data\neven if your key has been rotated.\n\nYou can also encrypt files. Pass a path to `--in-file` or `-` to read from `stdin`.\nNote that if you encrypt binary data, you cannot decrypt it to `stdout` but can write it to a file using `decrypt --out-file`.\n\n### Managing secrets\n\nYou can create, get, edit, and list secrets e.g.,\n\n```bash\nakv secret list --vault https://my-vault.vault.azure.net\n```\n\nRead complete usage using `--help`:\n\n```bash\nakv secret --help\n```\n\n### Managing keys\n\nYou can create, get, edit, and list keys e.g.,\n\n```bash\nakv key list --vault https://my-vault.vault.azure.net\n```\n\n### Managing certificates\n\nYou can create, get, edit, and list certificates, as well as get and edit certificate policies e.g.,\n\n```bash\nakv certificate list --vault https://my-vault.vault.azure.net\n```\n\nTo read and edit the certificate policy for the next rotation:\n\n```bash\nakv certificate get-policy --name my-cert --vault https://my-vault.vault.azure.net\nakv certificate edit-policy --name my-cert --vault https://my-vault.vault.azure.net \\\n    --reuse-key --validity 3\n```\n\n### Output format\n\nCommands that display resources such as `secret list`, `key get`, or `certificate list-versions` support `--output` to control the output format:\n\n- `--output default` — displays a formatted table or key-value summary (the default).\n- `--output json` — prints the raw JSON response for scripting or inspection.\n\nFor example:\n\n```bash\nakv secret list --vault https://my-vault.vault.azure.net --output json\nakv key get --name my-key --vault https://my-vault.vault.azure.net --output json\n```\n\n### Colors\n\nWhen the `color` feature is enabled (the default), JSON output and tables are colorized.\nYou can control color output with the `--color` flag (`always`, `never`, or `auto`).\n\nJSON colors are configured using the `JQ_COLORS` environment variable, using the same format as [`jq`][jq-colors].\nIf you already have `JQ_COLORS` configured for `jq`, `akv` will use the same colors automatically.\n\nThe format is 8 colon-separated `style;color` pairs:\n\n```text\nnull:false:true:number:string:array:object:object-key\n```\n\nFor example, the default is equivalent to:\n\n```bash\nexport JQ_COLORS=\"0;90:0;39:0;39:0;39:0;32:1;39:1;39:1;34\"\n```\n\n[jq-colors]: https://jqlang.org/manual/#colors\n\n## Background\n\nThough still a work in progress, inspiration was derived from the [1Password CLI].\nAs the previous primary developer on the [Azure Key Vault SDK for .NET](https://github.com/Azure/azure-sdk-for-net)\nand current primary developer on the [Azure SDK for Rust](https://github.com/Azure/azure-sdk-for-rust) - including Key Vault -\nI wanted to make something useful to test our initial prerelease of the Rust class libraries.\n\n## License\n\nLicensed under the [MIT](LICENSE.txt) license.\n\n[1Password CLI]: https://developer.1password.com/docs/cli/\n[Azure Developer CLI]: https://aka.ms/azure-dev\n[Azure Key Vault]: https://azure.microsoft.com/products/key-vault/\n[Homebrew]: https://brew.sh\n[Rust]: https://www.rust-lang.org/tools/install\n[Winget]: https://github.com/microsoft/winget-cli\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fheaths%2Fakv-cli-rs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fheaths%2Fakv-cli-rs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fheaths%2Fakv-cli-rs/lists"}