Secrets across devices

Move credential bundles between your machines without ever putting a plaintext value on the wire. The engine is the standalone secrets CLI (agents clis install secrets or npm i -g @phnx-labs/[email protected]). Pin the remote first: secrets hosts pin <alias>.

Account-wide sync

push encrypts a bundle locally and uploads it to api.prix.dev; pull decrypts it back into the local keychain on another machine. Plaintext never leaves the device — only ciphertext is stored account-wide:

agents secrets push stripe-prod   # encrypt + upload this bundle
agents secrets push --all         # push every local bundle
agents secrets remote-list        # what's stored for this account
agents secrets pull stripe-prod --force  # restore on another machine

Push straight to a machine over SSH

export --host lands the bundle as a native bundle on the target machine's keychain. Repeat --host to push to several at once; --force overwrites an existing bundle of the same name:

secrets hosts pin mac-mini
secrets export stripe-prod --host mac-mini --remote-backend file
secrets export stripe-prod --host mac-mini --host studio --force

List and run against a remote's bundles

--host works on read paths too — inspect which bundles exist on another machine, or inject a remote's bundle into a command:

agents secrets list --host mac-mini              # what's registered there
agents secrets exec prod --host mac-mini -- ./deploy.sh

Related