keepassxc-run

Pass secrets in KeePassXC databases as environment variables to an application or script. This project is inspired by op run command.

usage: keepassxc-run.py [options] -- [command ...]

positional arguments:
  command              command to execute. prepend "--" if you specify command option like "--version"

options:
  --help               show this help message
  --debug              Enable debug log
  --env-file ENV_FILE  Enable Dotenv integration with specific Dotenv files to parse. For example: --env-file=.env
  --no-masking         Disable masking of secrets on stdout and stderr.  

keepassxc-run depends on git-credential-keepassxc to fetch secrets from KeePassXC databases. Ensure that git-credential-keepassxc is installed and configured.

Usage

keepassxc-run scans environment variables for secret references, loads the corresponding secrets from KeePassXC databases, then runs the provided command in a subprocess with the secrets made available as environment variables for the duration of the subprocess.

If the same environment variable name exists in both the shell and the environment file, the environment file takes precedence. If the same environment variable name exists in multiple environment files, the last environment file takes precedence.

Examples

Suppose the KeePassXC database contains an entry like a image below.

Assume that TEST_PASSWORD environment variable is configured as below.

export TEST_PASSWORD="keepassxc://example.com/password"

If an environment variable starts with keepassxc://, keepassxc-run searches an entry matching URL in KeePassXC databases and pass a secret to subprocess as an environment variable value. keepassxc-run masks secret values in stdout and stderr by default as below.

$ keepassxc-run -- printenv TEST_PASSWORD
<concealed by keepassxc-run>

keepassxc-run turns off masking with --no-masking option.

$ keepassxc-run --no-masking -- printenv TEST_PASSWORD
testuser*p@ssw0rd

You can fetch additional attributes which start KPH: like below.

$ export TEST_PASSWORD="keepassxc://example.com/api_key"
$ keepassxc-run --no-masking -- printenv TEST_PASSWORD
my*api*key

Specify an environment file and use it:

echo "TEST_PASSWORD=keepassxc://example.com/password" > .env

$ keepassxc-run --no-masking --env-file .env -- printenv TEST_PASSWORD
testuser*p@ssw0rd

License

MIT License. See LICENSE for details.