Complete reference for all 31 commands. Search below to find specific syntax, options, and usage examples.
The CLI is distributed as an npm package. You can install it globally using your preferred package manager.
xtra --version to ensure the CLI is correctly installed.Login and authentication
Authenticate with XtraSecurity Cloud platform
| -k, --key <key> | Login using Access Key (non-interactive) |
| -e, --email <email> | Login using Email (will prompt for password) |
| --sso | Login via Web/Browser SSO |
Initialize and manage projects
Bootstrap a new project with .xtrarc configuration
| --project <id> | Project ID (skip interactive prompt) |
| --env <env> | Default environment |
| --branch <branch> | Default branch |
| -y, --yes | Accept all defaults automatically |
Set and manage default project context
Manage branches in a project
Switch to a different branch
Create, update, rotate secrets
Manage secrets (List, Set, Delete)
| -p, --project <projectId> | Project ID |
| -e, --env <environment> | Environment |
| -b, --branch <branchName> | Branch name |
Rotate a secret with Zero-Downtime Shadow Mode
| -p, --project <projectId> | Project ID |
| -e, --env <environment> | Environment |
| --strategy <strategy> | Rotation strategy |
| --promote | Promote shadow to active |
| --value <value> | New secret value |
View and manage secret versions
View version history of a secret
| -p, --project <id> | Project ID |
| -e, --env <environment> | Environment |
Rollback secret to previous version
| -p, --project <projectId> | Project ID |
| -e, --env <environment> | Environment |
Run commands with injected secrets
Run a command with injected secrets
| -p, --project <projectId> | Project ID |
| -e, --env <environment> | Environment |
| -b, --branch <branchName> | Branch Name |
| --shell | Enable shell mode (for npm run, pipes, etc.) |
Live reload - auto-restart on secret changes
| -p, --project <id> | Project ID |
| -e, --env <environment> | Environment |
| -b, --branch <branch> | Branch |
| --interval <seconds> | Poll interval |
| --shell | Use shell mode |
Dry-run: show what would be injected
| -p, --project <id> | Project ID |
| -e, --env <environment> | Environment |
| -b, --branch <branch> | Branch |
| --show-values | Reveal values |
| --diff | Compare with local env |
Generate and manage config files
Generate local configuration files (.env, JSON, YAML)
| -p, --project <projectId> | Project ID |
| -e, --env <environment> | Environment |
| -b, --branch <branchName> | Branch name |
| -o, --output <path> | Output file (full overwrite if specified) |
| -f, --format <format> | Format: env, json, yaml |
| --force | Skip prompts |
Import secrets from file (JSON, CSV, .env)
| -p, --project <projectId> | Project ID |
| -e, --env <environment> | Environment |
| -b, --branch <branchName> | Branch name |
| -f, --format <format> | Format: json, dotenv, csv (auto-detected) |
| --prefix <prefix> | Add prefix to all keys |
Export secrets to file (JSON, CSV, .env)
| -p, --project <projectId> | Project ID |
| -e, --env <environment> | Environment |
| -b, --branch <branchName> | Branch name |
| -f, --format <format> | Format: json, dotenv, csv |
| -o, --output <file> | Output file (default: stdout) |
Templating engine with placeholder substitution
Manage named configuration profiles
Environment and mode management
Toggle offline mode for local development
Environment management (clone, sync)
Audit trails and compliance
View local audit logs
| -n, --limit <number> | Number of logs to show |
| --sync | Sync unsynced logs to cloud |
| --event <type> | Filter by event type |
| --project <projectId> | Filter by project |
| --since <duration> | Show logs since (1h, 24h, 7d, 30d) |
| --json | JSON output |
Manage server-side audit logs
Security scanning and leak detection
Scan project for leaked secrets
| --staged | Scan only staged files |
| --install-hook | Install git pre-commit hook |
JIT access and permissions
Manage JIT access requests
Admin user and role management
User and role management (admin only)
External service integrations
Manage external integrations
Pipeline automation
CI/CD headless mode (JSON output, no prompts)
Utility and diagnostic commands
Check synchronization status with cloud
| -p, --project <projectId> | Project ID |
| -e, --env <environment> | Environment |
| -b, --branch <branchName> | Branch name |
Show differences between environments or local vs remote
| -p, --project <projectId> | Project ID |
| -e, --env <environment> | Environment |
| -b, --branch <branchName> | Branch name |
| --show | Show actual values |
Diagnose CLI setup and connectivity
| --json | JSON output |
Interactive terminal dashboard
Shell completion scripts
View local audit logs
| -n, --limit <number> | Number of logs to show |
| --sync | Sync unsynced logs to cloud |
| --event <type> | Filter by event type |
| --project <projectId> | Filter by project |
| --since <duration> | Show logs since (1h, 24h, 7d, 30d) |
| --json | JSON output |