movitera-cli 0.1.0

Movitera CLI: inject vault secrets as environment variables, generate TOTP codes

movitera CLI

Inject Movitera vault secrets as environment variables, render dotenv files, and generate TOTP codes from the terminal. Authenticates with a Movitera vault personal access token (PAT).

Install

pip install movitera-cli
# or install as an isolated CLI tool (recommended):
pipx install movitera-cli
# or with uv:
uv tool install movitera-cli
# or run without installing:
uvx --from movitera-cli movitera --help

Quick start

# 1. Mint a PAT in the web app (Settings → Vault → Access Tokens),
#    then paste it once:
movitera login

# 2. Run any command with secrets injected as env vars:
movitera run --team <teamId> --credential myapp-prod -- npm start

# 3. Or dump as dotenv:
movitera secrets pull --team <teamId> --credential myapp-prod > .env

# 4. Or generate a TOTP code for a credential:
movitera totp --team <teamId> <credential-id>

How it works

movitera run -- cmd fetches the dotenv body from GET /vault/credentials/by-name/{name}/env, then execs the child process with those vars merged into its environment. The CLI never writes secrets to disk — they exist only in the child process's environ.

Tokens are stored in the OS keyring (Keychain on macOS, libsecret on Linux, Credential Manager on Windows) with a file fallback under ~/.config/movitera/token (mode 0o600) if no keyring backend is available.

Config

Env var	Purpose	Default
MOVITERA_API_URL	API base URL	https://api.movitera.com
MOVITERA_TOKEN	PAT override (skips keyring lookup)	—
MOVITERA_TEAM	Default team id (you can omit --team)	—

Commands

movitera login

Prompts for a PAT (or reads it from stdin via --stdin) and stores it.

movitera logout

Removes the stored PAT.

movitera run --team T --credential N -- <cmd> [args...]

Fetches the ENV_BUNDLE credential named N and execs <cmd> with those vars in the environment.

movitera secrets pull --team T --credential N

Writes the dotenv body to stdout. Exits non-zero on resolution failures so you can chain movitera secrets pull ... > .env.

movitera totp --team T <credential-id>

Prints the current TOTP code for the credential's OTPAUTH_URI field.

movitera tokens list --team T / movitera tokens revoke <id>

Manage your own PATs from the CLI.

Security model

• PATs have full 256-bit entropy and are stored as SHA-256 on the server, so a server compromise cannot recover the plaintext.
• Every movitera run invocation is audited server-side, but PAT reads are coalesced per hour per token (see the backend's FETCHED_VIA_TOKEN aggregation) so a hot dev loop doesn't drown the log.
• Group/team access is re-checked on every request: if your vault scope is revoked, your PAT immediately loses access — no token-cache divergence.