hoziron-cli vault

Credential vault — securely store and manage secrets for integrations and providers.

The vault is a real, encrypted-at-rest, daemon-owned store reachable only through an authenticated API. hoziron-cli vault subcommands are thin clients against that API: nothing is read from or written to the local filesystem by the CLI itself, so they work identically against a local or a remote daemon context.

Synopsis

hoziron-cli vault <subcommand> [options]

Subcommands

SubcommandDescription
initNo-op — the vault is created automatically by the daemon on first use
set <key>Store a credential (prompts for value, not echoed)
listList stored keys with timestamps (values are never shown or retrievable)
remove <key>Remove a credential

hoziron-cli vault init

Nothing to initialize client-side — vault.db and its master key are created lazily by the daemon the first time a credential is stored.

$ hoziron-cli vault init
Nothing to do: the vault is created automatically by the daemon on first use. Run `hoziron-cli vault set <key>` to store a credential.

hoziron-cli vault set

Store a credential under <key> (the env var name a provider/registry/channel config references via its *_env field). The value is prompted interactively and never echoed.

hoziron-cli vault set <key>

Examples

$ hoziron-cli vault set ANTHROPIC_API_KEY
Enter value for ANTHROPIC_API_KEY: ********
Stored 'ANTHROPIC_API_KEY' in the vault.

$ hoziron-cli vault set GITHUB_TOKEN
Enter value for GITHUB_TOKEN: ********
Stored 'GITHUB_TOKEN' in the vault.

Setting an existing key overwrites it in place — the change is picked up by the next credential resolution with no daemon restart required.

hoziron-cli vault list

List all stored keys and when they were last written. Values are never shown — there is no API to read a stored value back once written.

$ hoziron-cli vault list
Stored credentials:
  ANTHROPIC_API_KEY  (2026-06-01T10:03:00Z)
  GITHUB_TOKEN  (2026-06-02T14:22:11Z)

$ hoziron-cli vault list
No credentials stored.

hoziron-cli vault remove

$ hoziron-cli vault remove GITHUB_TOKEN
Removed 'GITHUB_TOKEN' from the vault.

How the Vault Works

  • Storage is SQLite ($HOZIRON_HOME/vault.db, WAL mode, 0600). Each row is independently salted, nonced, and encrypted with AES-256-GCM, so rotating one key never re-encrypts unrelated entries.
  • Both set/remove (vault:manage) and list (vault:read) are admin-only actions, gated at the same RBAC bar as API key management.
  • Provider api_key_env and registry auth_token_env resolve through a single chokepoint (vault first, process-env fallback) — a value stored here always wins over a conflicting value in the process environment.
  • Every resolution is audited with credential_source: vault|env metadata, so which mechanism supplied a given credential is always traceable.
  • The vault is local to the daemon's host — for container deployments, prefer injecting secrets via your container platform's native secrets mechanism (e.g. Docker Secrets) unless the daemon itself is the one persisting state.

Vault vs Environment Variables

ApproachBest For
VaultLocal development, bare metal, persistent secrets
Environment variablesContainers, CI, orchestrator-managed secrets

Both work. The vault provides convenience for interactive use and survives daemon restarts without re-exporting anything; env vars are better for automated/ephemeral environments.

Channel Secrets

hoziron-cli channel setup stores a channel's bot/app token via the same vault, for the channels it knows how to fully wire up (discord, telegram, slack, mqtt; mqtt's prompt is a non-secret broker URL, not a vault entry). Other channel types must be configured directly in config.toml, storing the secret first with hoziron-cli vault set <NAME> and referencing that name from the channel's *_env field.

See Also