Skip to main content
The Barekey CLI is the fastest way to work with Barekey day to day. Use it to:
  • log in on a machine
  • create, update, list, and delete variables
  • pull resolved values into files
  • generate SDK types

​
Install

npm install -g @barekey/cli

​
Authentication

​
barekey auth login

Starts the browser-based device flow: 
barekey auth login
Optional: 
barekey auth login --base-url https://api.barekey.dev
What it does:
  • starts a device authorization request
  • prints the verification URL and code
  • opens the browser when possible
  • stores the session locally after approval

​
barekey auth whoami

barekey auth whoami
barekey auth whoami --json

​
barekey auth logout

barekey auth logout
Top-level aliases also exist:
  • barekey login
  • barekey whoami
  • barekey logout

​
How target resolution works

Every environment command needs a target:
  • organization
  • project
  • stage
The CLI resolves those from:
  1. command flags
  2. barekey.json
  3. stored CLI session org for organization only

​
Target flags

Most env and typegen commands accept: 
--org <slug>
--project <slug>
--stage <slug>

​
barekey.json

Recommended project file: 
{
  "organization": "acme",
  "project": "web",
  "environment": "development",
  "config": {
    "typegen": "semantic",
    "mode": "centralized"
  }
}
Supported aliases:
  • org for organization
  • stage for environment

​
Missing target errors

If the CLI cannot resolve project and environment, it fails and tells you to either:
  • pass --project and --stage
  • or create a barekey.json

​
Command reference

​
barekey env list

List variables in the resolved stage: 
barekey env list
barekey env list --json
The non-JSON output includes:
  • name
  • visibility
  • kind
  • declared type

​
barekey env get

Read one resolved variable: 
barekey env get DATABASE_URL
Options: 
barekey env get CHECKOUT_FLOW --seed user-42 --key checkout-v1
barekey env get DATABASE_URL --json
Flags:
FlagMeaning
--seed <value>deterministic seed for ab_roll
--key <value>deterministic namespace key
--jsonmachine-readable output

​
barekey env get-many

Read multiple values in one command: 
barekey env get-many --names DATABASE_URL,REDIS_URL
barekey env get-many --names DATABASE_URL,REDIS_URL --json
Flags:
FlagMeaning
--names <csv>comma-separated variable names
--seed <value>deterministic seed for ab_roll values
--key <value>deterministic namespace key
--jsonmachine-readable output

​
barekey env new

Create a variable with its first value: 
barekey env new DATABASE_URL "postgres://localhost:5432/app"
Flags:
FlagMeaning
--type <type>declared type: string, boolean, int64, float, date, json
--visibility <visibility>private or public
--ab <value-b>create an ab_roll with A value from the positional <value> and B value from --ab
--chance <number>required when using --ab, from 0 to 1
--jsonmachine-readable output
Example: 
barekey env new FEATURE_ENABLED true --type boolean
barekey env new PUBLIC_TITLE "Barekey" --visibility public
barekey env new CHECKOUT_FLOW original --ab redesigned --chance 0.2

​
barekey env set

Upsert a variable: 
barekey env set DATABASE_URL "postgres://localhost:5432/app_v2"
This creates the variable if it does not exist and updates it if it does. It accepts the same flags as env new. Examples: 
barekey env set FEATURE_ENABLED false --type boolean
barekey env set CHECKOUT_FLOW control --ab treatment --chance 0.5
barekey env set PUBLIC_TITLE "Barekey Docs" --visibility public

​
barekey env delete

Delete a variable: 
barekey env delete OLD_KEY
Flags:
FlagMeaning
--yesskip the confirmation prompt
--ignore-missingdo not fail if the variable does not exist
--jsonmachine-readable output
Examples: 
barekey env delete OLD_KEY --yes
barekey env delete OLD_KEY --yes --ignore-missing

​
barekey env pull

Resolve the whole stage and either print or write the result. 
barekey env pull
barekey env pull --out .env.local
barekey env pull --format json --out barekey.local.json
Flags:
FlagMeaning
--format <type>dotenv or json
--out <path>write to a file instead of stdout
--seed <value>deterministic seed for ab_roll values
--key <value>deterministic namespace key
--redactif printing to stdout in a non-TTY context, show only a summary
Examples: 
barekey env pull --out .env.local
barekey env pull --format json --out barekey.local.json
barekey env pull --seed user-42 --key checkout-v1 --out .env.local

​
Output formats

dotenv: 
DATABASE_URL=postgres://localhost:5432/app
FEATURE_ENABLED=true
json: 
{
  "DATABASE_URL": "postgres://localhost:5432/app",
  "FEATURE_ENABLED": "true"
}

​
barekey typegen

Generate SDK types into your installed @barekey/sdk package: 
barekey typegen
Watch mode: 
barekey typegen --watch
barekey typegen --watch --interval 3000
Flags:
FlagMeaning
--watchkeep polling and regenerate when needed
--interval <ms>watch poll interval in milliseconds
--org <slug>override organization
--project <slug>override project
--stage <slug>override stage

​
Day-to-day recipes

​
Create a variable and verify it

barekey env new DATABASE_URL "postgres://localhost:5432/app" --type string
barekey env get DATABASE_URL

​
Update a public variable

barekey env set PUBLIC_TITLE "Barekey Docs" --visibility public

​
Pull local dev values

barekey env pull --out .env.local

​
Pull JSON for scripts

barekey env pull --format json --out barekey.local.json

​
Regenerate SDK types after variable changes

barekey typegen

​
Notes and gotchas

  • env new requires an initial <value>.
  • env set is the upsert command.
  • get-many expects a comma-separated --names value.
  • The CLI can reuse your saved login automatically.
  • barekey.json is safe to commit because it contains configuration, not secrets.
  • Pulled .env files are not safe to commit.
For SDK usage details, read JavaScript SDK.