Keep your service keys in csec.

An access key is a password that lets software use an online service. csec keeps those values in encrypted storage on your computer so a tool can retrieve a key when it needs it.

This is a terminal tool. A developer or someone comfortable with your computer's command line can help with setup.

1. Install

The first installation trusts this download source and HTTPS. It downloads and runs software on your computer. Later updates are checked against a signing key inside the installed tool.

macOS or Linux

curl -fsSL https://csec.limbs.dev/install | bash

Windows PowerShell

irm https://csec.limbs.dev/install.ps1 | iex

Follow the installer's path instructions if your terminal cannot find csec. Then check:

csec version

2. Save a key

First obtain a key from the service you want to use. Replace SERVICE_API_KEY below with the name your tool expects:

csec set SERVICE_API_KEY

Enter the value at the hidden prompt. This saves it locally. Keep the actual value out of chat, project files and the command itself.

To see saved names without printing their values:

csec ls

3. Connect the tool that needs it

Follow that tool's credential setup. ahh, for example, retrieves its configured service keys from csec. A tool that is not integrated with csec needs an explicit retrieval step.

csec get NAME prints the secret value. Use it only where you intend that value to be visible, and do not paste its output into a shared report. Use csec --help for the commands supported by your installed version.

What to know before using it

• Encryption protects stored values. Programs running as your operating-system user can still retrieve them; csec does not make a compromised computer safe.
• On Linux without a desktop keyring, a file restricted to your account holds the master key. Disk encryption remains useful.
• Synchronisation is a separate setup step. It uses encrypted snapshots in a private Git repository. Do not copy store.enc alone to another computer: its master key stays on the original machine.
• A local deletion can be restored by a later sync. Read csec sync help before changing a synchronised collection.

Automatic update checks send the publisher your operating-system username, hostname, platform and csec version; the server also sees connection information such as your IP address. Set CSEC_UPDATE_DISABLE=1 for processes where you want these automatic checks disabled.

If something fails

Read the reported error before changing files. A missing or unreadable key does not mean the encrypted store should be deleted or replaced. Preserve the store and any recovery material while you investigate.