Secrets across devices

Move credential bundles between your machines without ever putting a plaintext value on the wire — the value is encrypted before it leaves the device, or lands as a native Keychain bundle on the far end.

Account-wide sync

push encrypts a bundle locally and uploads it to api.prix.dev; pull decrypts it back into the local keychain on another machine. Plaintext never leaves the device — only ciphertext is stored account-wide:

agents secrets push stripe-prod   # encrypt + upload this bundle
agents secrets push --all         # push every local bundle
agents secrets remote-list        # what's stored for this account
agents secrets pull stripe-prod --force  # restore on another machine

Push straight to a machine over SSH

export --host lands the bundle as a native bundle on the target machine's keychain. Repeat --host to push to several at once; --force overwrites an existing bundle of the same name:

agents secrets export stripe-prod --host mac-mini
agents secrets export stripe-prod --host mac-mini --host studio --force

List and run against a remote's bundles

--host works on read paths too — inspect which bundles exist on another machine, or inject a remote's bundle into a command:

agents secrets list --host mac-mini              # what's registered there
agents secrets exec prod --host mac-mini -- ./deploy.sh

Related

• Secrets — the bundle model and the one-prompt-per-day policy.
• Devices overview — the one-flag model.
• Register devices — password auth reads from these bundles.