The remem command-line tool

Approvals

When a program asks for a secret, the Mac app shows a Touch ID prompt naming it. Approvals are remembered per program and per item, for the time set in Settings → Terminal access → After you approve a program: Ask every time, Remember for 5 minutes (the default), Remember for 30 minutes or Remember for 8 hours. Locking drops every approval, whichever you choose, and so does Forget approvals now.

Vault references

A reference points at a secret without containing it, so it is safe to put in a README, a template or a chat: remem://<vault>/<item>/<field>. Your vault is called Personal. Leave the field off to mean the item’s password. An ambiguous reference is an error, never a guess.

In the Mac app, right-click an item and choose Copy CLI reference to copy one.

remem read "remem://Personal/OpenAI/api_key"
export GH_TOKEN=$(remem read -n remem://Personal/GitHub/token)

remem read refuses to write to a file unless you add --allow-file.

Run a program with its secrets

A CLI profile item maps variable names to references. remem run puts those variables into one child process only: not your shell, not its history, not the next command.

remem run --profile ai-tools -- npm start
remem run --profile ai-tools --no-mask -- claude

Anything the program prints that matches one of its secrets is shown as [remem]. That is a safety net, not a guarantee. Programs that draw their own full-screen interface need --no-mask.

For tools that can’t be wrapped:

eval "$(remem env --profile ai-tools)"
remem env --profile ai-tools --format dotenv
remem inject -i .env.tpl | docker compose --env-file - up

remem inject understands both remem://… and {{ remem://… }} and resolves each distinct reference once.

Link a repository

1. In the Mac app, right-click an item and choose Use in a project…, which suggests a variable name and a profile and copies a remem link command.
2. Paste it in a terminal inside the repository. It adds the variable to the profile and writes a .remem.toml naming the profile.
3. From then on, remem run -- <command> in that repository needs no --profile.

remem link ANTHROPIC_API_KEY=remem://Personal/Anthropic --profile claude
remem run --no-mask -- claude

Because .remem.toml arrives with every git pull, approval is pinned to the file’s contents. A changed file asks again. remem trust approves it explicitly; --profile on the command line ignores the file.

Codes, passwords and items

remem totp GitHub                 # code on stdout, countdown on stderr
remem generate                    # 24-character password, no vault needed
remem generate --passphrase --words 6
remem item list                   # titles only, never a value
remem item get GitHub --reveal    # asks first
remem item add "Router" --template custom --secret "Admin PIN"
remem item add "Anthropic" --template apiKey --secret "API key" --from-clipboard

Secrets are asked for without echo, or read from the clipboard with --from-clipboard (which clears it afterwards). They are never taken from the command line. Every add and edit is approved in the app.

SSH agent and commit signing

1. Store the key in an SSH key item: the OpenSSH private key in Private key, and its passphrase, if it has one, in Passphrase.
2. Start the agent and point SSH at it, as below.
3. Each signature asks for approval. The key is decrypted inside the agent for that one signature and never written to disk unencrypted.

remem ssh-agent &
export SSH_AUTH_SOCK="$(remem ssh-agent --print-path)"
ssh git@github.com

Ed25519 keys are recommended. RSA keys only work with servers that accept rsa-sha2-512. To sign git commits and tags with the key:

remem ssh-agent git-config "GitHub SSH"          # print the settings
remem ssh-agent git-config "GitHub SSH" --apply  # apply them globally

Git credential helper

git config --global credential.helper '!remem git-credential'

Git asks Remem, Remem asks you, and nothing is written to ~/.git-credentials. The item is matched on its Website field (scheme, host and port), never on its title. Git can’t create or delete vault items through the helper.

Without the app: remem agent

remem agent answers requests in a terminal instead of the app, and asks for approval there. It reads the vault data the Mac app has already saved on that machine; it doesn’t sync, and there is no supported way to put a vault on a machine that has never run the app. --allow-all approves everything without asking and is meant for CI.

Exit codes