ARCA CLI reference.

Reads a .env file once and stores those keys on an Env item. After import, the vault is the source of truth.

# Stripe production — import once, then stop committing this fileSTRIPE_KEY=sk_live_replace_meSTRIPE_WEBHOOK_SECRET=whsec_replace_me

# Stripe local — same keys, different values, default stays untouchedSTRIPE_KEY=sk_test_replace_meSTRIPE_WEBHOOK_SECRET=whsec_test_replace_me

$ arca env import --item Stripe --branch production --from-file .env.production --yes$ arca env import --item Stripe --branch local --from-file .env.local --yes

Exit 0 success. 1 Pro required. 5 missing title without --yes, kind mismatch, or illegal branch.

Creates an Env item with secret fields on the default environment.

$ arca add --kind env --title Stripe --secret-field STRIPE_KEY --tag billing

Exit 0 success. 5 ambiguous title on later address.

A committed .env can mix arca://Item/KEY refs and plain literals. At inject, each ref is replaced with that field from the vault.

GH_TOKEN=arca://GitHub/passwordDATABASE_URL=arca://App DB/urlRUST_LOG=debug

$ arca inject --env-file .env -- npm start

Exit Inject: exit 5 if a reference is unresolved, a blob field is named, or the field name is not unique on default.

Starts one child process whose environment contains secrets from a vault selector or a disk template.

$ arca inject --env-file @Stripe/production -- cargo test

Exit 0 or the child's status. 1 Pro required. 5 unresolved ref, missing branch, or ambiguous field. 8 if --app and the app is missing.

Local HTTPS credential broker. The child never sees vault fields. Sets HTTPS_PROXY, dummy conventional env, and CA trust vars. Arca terminates TLS for granted hosts and attaches Authorization: Bearer <secret>.

$ arca agent --github GitHub --anthropic Anthropic --ttl 900 -- claude$ arca agent --openrouter OpenRouter --groq Groq -- claude$ arca agent --github GitHub --ssh Laptop -- git push$ arca agent --npm NpmToken -- npm publish$ arca agent --nous Hermes --npm npm --vercel Vercel --ttl 900 -- hermes

Exit 0 or the child's status. 1 Pro required (agent grants stderr). 8 app required (--direct cannot invent a broker).

Standalone broker. No child. Dies on TTL, lock, or stop — not on child-exit.

$ arca agent start --github GitHub --ttl 900 --yes

Exit 0 success. 1 Pro required (agent grants stderr). 8 app required.

Inspect or tear down a live broker. Always free.

$ arca agent status$ arca agent stop

Exit 0 success. 8 app required.

Serves a vault SSH key on ~/.arca/agent.sock for a TTL. You can also import a file, then serve it. Keys never leave the app.

$ export SSH_AUTH_SOCK="$HOME/.arca/agent.sock"$ arca ssh add Laptop --ttl 3600

Exit 0 success. 1 Pro required. 8 app required (agent lives in the app).

List, revoke one, or flush all served keys.

$ arca ssh list$ arca ssh remove Laptop$ arca ssh flush

Exit 0 success (including empty list). 8 app required.

Sign commits through the in-app agent after pointing SSH at ~/.arca/agent.sock and serving a key.

$ export SSH_AUTH_SOCK="$HOME/.arca/agent.sock"$ arca ssh add git-signing --ttl 3600$ git commit -S -m "signed with a key that never exists on disk"

Exit Git's status. ssh add is Pro; the socket is empty until a key is served.

Creates a vault file at PATH. Calibrates the KDF, asks for a password, and prints recovery shares.

$ arca init /tmp/vault.arca

Exit 0 success. 1 weak password after three refusals.

Checks the password and records the path as the default vault.

$ arca unlock /tmp/vault.arca

Exit 0 success.

Locks the app session. With --quit-app, asks the app to quit after locking.

$ arca lock

Exit 0 success. 8 if --quit-app and the app is missing.

Changes the vault password. Prompts; never flags.

$ arca --direct --file /tmp/vault.arca change-password

Exit 0 success. 9 if the app has the vault open.

Creates a named inner vault in the open envelope. No new password; wraps to the envelope master key. There is no delete.

$ arca vault create work$ arca --direct --file ~/vault.arca vault create lab

Exit 0 success. 1 Pro required. 5 That vault could not be created.

Lists named inner vaults in the envelope. * marks the active vault. Free.

$ arca vault list$ arca --direct --file ~/vault.arca vault list$ arca --json vault list

Exit 0 success.

Renames an inner vault. Identity (UUID) is unchanged. There is no delete.

$ arca vault rename work job

Exit 0 success. 1 Pro required. 5 No vault with that name. / That vault could not be renamed.

Creates an item. Secret values are prompted; they never go on the command line.

$ arca add --kind login --title GitHub --secret-field password --tag work

Exit 0 success.

Prints item metadata. An optional query is a substring match on titles.

$ arca --json list --kind env

Exit 0 success, including an empty list.

Prints metadata, or one non-secret field.

$ arca get GitHub$ arca get Laptop --field public_key

Exit 0 success. 5 no such item/field or ambiguous title. 9 secret field refused in this mode.

Updates title, tags, and fields on an existing item.

$ arca edit GitHub --add-tag prod --set-secret-field password

Exit 0 success. 5 no such item.

Deletes an item after confirm. --yes skips the prompt.

$ arca remove GitHub --yes

Exit 0 success, including a declined confirm.

Copies a secret to the clipboard. The clipboard clears after 45 seconds.

$ arca copy GitHub

Exit 0 success. 9 without the app (no standalone clipboard guard).

Prints a secret to stdout.

$ arca --direct --file /tmp/vault.arca show GitHub --field password

Exit 0 success. 5 several secrets and no --field. 9 over IPC.

Prints a password, API key, or passphrase. Without --save, no vault is required.

$ arca generate --kind password --length 24

Exit 0 success.

Rebuilds the vault from paper shares, then immediately asks for a new password.

$ arca --file /tmp/vault.arca recover --shares 3

Exit 0 success.

Prints a new share set and invalidates the previous one.

$ arca --file /tmp/vault.arca export-shares --threshold 3 --shares 5

Exit 0 success.