Command line (CLI)
credenshare creates and manages shares and secure requests from a terminal or a script. Content is encrypted on your machine, with the same encryption the web app uses, before anything is sent.
It needs an API key, which Business and Enterprise plans create in the app's account settings, on the Developer tab. See Getting a key.
Install
Download the archive for your platform from the releases: macOS (Intel and Apple silicon), Linux (x86-64 and ARM64) or Windows (x86-64 and ARM64). Check it against SHA256SUMS, put credenshare on your PATH, then run:
credenshare self-check
It checks the encryption in the binary you installed against the published test vectors.
The binaries are not code-signed yet. On macOS, a binary downloaded through a browser is quarantined; remove the flag with xattr -d com.apple.quarantine ./credenshare, or download with curl, which does not set it. On Windows, if a downloaded credenshare.exe is blocked, run Unblock-File .\credenshare.exe in PowerShell.
Sign in
credenshare auth login
asks for the key at a hidden prompt, checks it, and keeps it in the system keychain. For CI, and on machines with no keychain, set CREDENSHARE_API_KEY instead.
Share a secret
echo "$DEPLOY_TOKEN" | credenshare share --field "Deploy token" --expires 24h --views 1
prints the share's link. Values are never taken as command-line arguments, which end up in shell history: each comes from a hidden prompt, from stdin, or from a file (--file "Private key=./key.pem"). Add --passcode to require one. Add --notify viewed,denied to be emailed when the share is viewed or a view is refused; expired and deleted are the other two events.
Ask for a secret
credenshare request --field "Database password:password" --title "Staging DB"
prints a link to send to the person who has the secret. It lets them submit, never read. What they submit is sealed to a key that stays on your machine, and the CLI decrypts it there:
credenshare receive AbC123
export DB_PASS=$(credenshare receive AbC123 --wait --field "Database password")
Other commands
| Command | What it does |
|---|---|
credenshare list [shares|requests] [--status expired] | Short codes and expiry times, never content. --status expired lists the shares that have ended and the requests that have closed |
credenshare audit CODE | Who opened a share, newest first, with link previews and mail scanners named. Needs a key with the audit:read scope; --since 7d, --all |
credenshare capabilities | What the key may do: its scopes, its plan's limits and features, and, for a team key, the team's sharing policy and where its links point |
credenshare show CODE | A share's or a request's details |
credenshare expire CODE | Expires a share now |
credenshare request delete CODE | Closes a request; run again to delete it and its submissions |
credenshare stats | Share counts and the last 14 days of views |
credenshare generate | A password, passphrase or PIN, generated offline |
Every command takes --json. Exit codes: 0 done, 1 usage or a local problem, 2 not signed in or the key refused, 3 not found or nothing arrived in time, 4 refused by the plan, the key's scopes or the team's sharing policy, 5 the network or the server.
A team key acts inside its team, so the team's sharing policy applies.
Where links point
Links the CLI prints use https://crs.sh, or, with a team key whose team has a custom domain, that domain. Set CREDENSHARE_LINK_ORIGIN to choose the origin yourself. credenshare capabilities shows a Links line for a team with a custom domain, and its --json output carries link_origin.
Opening a share from the terminal is not possible: open links in a browser.