The authguard-secrets command-line tool (CI and applications)

authguard-secrets fetches short-lived application secrets from AuthGuard's vault for a CI job, a container or a server, using the identity the platform already gives the job. The tool is built; the server endpoints it calls (/v1/workload/token and /v1/workload/secrets:batchGet) arrive with the application secrets API, so it cannot be used against a live organization yet.

Which commands are there?

A SPEC is [VAR=]name[#field]. A key-value secret without a field becomes one variable per key, with the prefix you give. Two specs may not set the same variable.

Which options does it need?

With auto, the tool detects GitHub Actions, GitLab CI or Kubernetes from the job's environment.

Example: GitHub Actions

permissions:
  id-token: write   # lets the job request its identity token
  contents: read
steps:
  - run: authguard-secrets exec DB_PASSWORD=billing-db -- ./deploy.sh
    env:
      AUTHGUARD_URL: https://acme.example.pt
      AUTHGUARD_WORKLOAD_ID: 00000000-0000-0000-0000-000000000000

What does the tool guarantee?

• HTTPS only, no redirects, and a 1 MiB limit on answers.
• The access token lasts 5 minutes and is bound to an ephemeral key (DPoP) created for the run.
• Each secret arrives sealed to that key; nothing is cached on disk.
• Files are created with mode 0600 and never overwritten without --force.
• Errors print fixed text or an error code, never a secret or a server description.

Exit code 2 means a usage error. See API authentication for the other machine credentials.