⌨️ Inheriti® CLI
The Inheriti® CLI (inheriti) lets you work with your protection plans from a terminal. You can sign in, find plans, copy an approved field to your clipboard, or hand an approved secret straight to a command so it never appears in a script, a shell history or a log.
Install
You need Node.js 22. Download the CLI package for your system from the Installation tab, open a terminal in the folder that holds it and run the command from Installation instructions. It looks like this:
npm install --global ./<downloaded-file>.tgz
inheriti help
On Windows, use PowerShell and .\<downloaded-file>.tgz. inheriti help works without signing in.
Sign in and choose an organisation
inheriti login # opens your browser to sign in
inheriti organizations list # shows your organisations and the current one
inheriti organizations use <organisation-id>
inheriti logout # clears the local session
Sign-in needs an interactive terminal. The CLI remembers the choice, and can keep the Organisation Key for the length of your session so you are not asked on every command.
Find a plan without opening anything
inheriti plans list --limit 20
inheriti plans show <plan-id>
inheriti plans logs <plan-id> --limit 5
These commands show names, assets, field names, participants and access rules, never values. Use --json for machine-readable output (it is the only format with a paging cursor), --all to fetch up to 50 pages, and --cursor to continue. In a terminal you can leave the plan ID out and pick one from a list.
Copy an approved field
inheriti plans reveal <plan-id> --field credentials.password --clipboard-ttl 30s
The CLI runs the plan's access flow, then copies the value to your clipboard without printing it. Repeat --field for several, or leave it out in a terminal to choose with the space bar. Each copy is approved and logged separately. --clipboard-ttl clears the clipboard afterwards. That is a best-effort cleanup: it cannot erase clipboard history or other programs' copies.
A field is written asset.field, for example credentials.password. You find these names in the plan's Data tab, or with inheriti plans show.
Give a secret to a command
plans use starts exactly the program you name after --, without a shell, and gives it only the fields you choose:
inheriti plans use <plan-id> --env API_TOKEN=credentials.token -- your-command
| Option | Delivers the field as |
|---|---|
--env NAME=asset.field | An environment variable for that program only |
--stdin asset.field | The program's standard input (one field) |
--fd N=asset.field | A file descriptor numbered 3 to 255 |
--temp-file NAME=asset.field | A restricted temporary file, removed afterwards |
--socket NAME=asset.field | A local socket that accepts one connection |
--ttl 30s | A time limit for the whole command (ms, s, m and h are accepted) |
--output suppress|inherit | Whether the program's output is shown. Hidden by default |
Environment variables can be read by other programs of the same user, and the program that receives a secret decides what it does with it. Keep secrets out of command arguments and logs. Show the exact command to whoever must approve it before running it, especially when an AI agent runs it.
Use it in scripts
inheriti secrets exec <plan-id> --env DB_PASSWORD=database.password -- ./deploy.sh
inheriti secrets resolve <plan-id> --field database.password --allow-plaintext-output | trusted-consumer
secrets exec is the version for scripts: same idea as plans use with environment variables. secrets resolve writes one raw value to its output for a trusted program to read, so it insists on --allow-plaintext-output and refuses to print to a terminal. For unattended jobs, see Automation.
Other commands
| Command | What it does |
|---|---|
inheriti plans create | Opens a window to create a plan, optionally prefilled with --title, --description and --asset |
inheriti plans download <plan-id> --asset <code> --output <path> | Saves an approved file to a new file only you can read. Existing files are never overwritten |
inheriti plans abort <plan-id> | Ends your unfinished access request, so the next reveal starts fresh |
inheriti setup | Offers to turn on shell auto-completion |
inheriti completion bash|zsh|fish | Prints the completion script |
inheriti update | Checks for a newer version (--install installs it) |
inheriti help <command> | Full options for any command |
Every command accepts --organization <id> to use a different organisation for that command only.
If something goes wrong
- Plan or field missing: check the selected organisation, then run
inheriti plans showto see the exact names. - Access is waiting for approval: follow the plan's steps in SafeKey Mobile.
inheriti plans abortends a stuck request. - You need exact syntax:
inheriti help plans use(or any command) works offline.
Next: Inheriti® MCP.