CLI

The Clawise CLI (clawise) is a single binary that wraps the HTTP API for terminal use and scripting. It also hosts the local vault: clawise auth initializes it, clawise vault manages credentials inside it, and clawise daemon runs the forward proxy that resolves clawise://... placeholders into real secrets at egress.

Use the CLI for one-shot terminal commands, shell automation, and the local secret proxy for agents. For application code, use the SDKs.

Install

The CLI is in private beta — the binary is distributed through your account manager. Once the source repo is public:

go install github.com/clawise/clawise-cli@latest

Verify:

clawise --help

Authenticate

clawise auth add initializes (or imports) your local vault. Three concepts come up:

• API key — identifies your org. Created at app.clawise.dev/api-keys. Required scopes: vault:read, vault:write.
• Master key — derived locally, never sent to the server. Encrypts your data key.
• Recovery code — one-time string emitted at setup. Required to re-import your vault on a new machine.

For the crypto model, see Vault → Credentials.

clawise auth add

Interactive flow: paste API key → CLI generates master key, encrypts data key, prints a one-time recovery code → save the recovery code and type I have saved to confirm. If your vault is already initialized on the server, the CLI prompts for your recovery code instead and imports the vault locally.

Commands

Args in <> are required, [] are optional. Timeouts are in seconds.

auth

• auth add — Initialize or import vault (interactive)
• auth list — List configured orgs
• auth switch <orgID> — Switch active org
• auth show [orgID] — Show auth status (connection, vault unlock, masked key)
• auth delete [orgID] — Remove org from local keychain (interactive)

mail

• mail inbox create [email-or-username] — Create inbox. Positional: full email, username (uses mail.clawise.dev), or omit for random. Optional --display-name
• mail inbox list — List inboxes. Optional --limit (20), --cursor
• mail inbox get <email> — Get inbox
• mail inbox update <email> — Rename inbox. Requires --display-name
• mail message send — Send outbound. Required --from --to --subject --body. Optional --body-html --cc --bcc --attach (all repeatable)
• mail message list — List messages. Required --inbox. Optional --direction <inbound|outbound>, --limit (20), --cursor
• mail message get <id> — Get message
• mail message reply <id> — Reply. Requires --body. Optional --body-html --subject --cc --bcc
• mail message wait — Long-poll inbound; exits non-zero on timeout. Required --inbox. Optional --since <rfc3339>, --timeout (30s)

phone

• phone services [filter] — List supported services (filter is substring match)
• phone verification create — Rent a number. Required --service, --country-code. Optional --number-type
• phone verification wait-for-code <id> — Wait for OTP. Optional --timeout (120s)
• phone verification cancel <id> — Cancel verification

captcha

• captcha detect — Inspect page over CDP for captcha. Required --cdp <url>. Optional --timeout (10s)
• captcha auto-solve — Solve and inject solution into the browser. Required --cdp <url>. Optional --timeout (120s)
• captcha solve — Headless solve. Required --params <json|@file|@-> OR --type image --body <base64|@filepath>. Optional --timeout (120s)

vault

• vault list — List credentials. Optional --search, --url, --type
• vault get <id> — Get credential
• vault create — Create credential. Required --name. Optional --type (password), --value OR --generate [--length=32] [--no-symbols], --username, --url
• vault delete <id> — Delete credential
• vault rotate — Rotate master key (invalidates previous recovery code)
• vault recovery — Re-export current recovery code

daemon

• daemon start — Run local forward proxy (Ctrl-C to stop). Optional --proxy-port, --pull-interval
• daemon status --ca-path — Print path to the daemon's CA cert

Global controls

Flags

Environment variables

Files and storage

Storage follows XDG conventions. API keys and the master key live in the OS keychain (Keychain on macOS, Secret Service on Linux, Credential Manager on Windows) — never in a plain file.

Losing the master key (e.g., wiped keychain) requires the recovery code to re-import the vault.

Output and exit codes

All commands write JSON to stdout. Errors and progress go to stderr; use -q to silence stderr. Pipe directly to jq:

clawise mail inbox list | jq '.data[].email'

See also

• Mail · Phone · Captcha · Vault — module docs
• SDKs — equivalent operations from Go / Python / TypeScript
• API — raw HTTP reference
• Daemon Proxy — how the local proxy works