Devolutions CLI

Commit the reference, never the secret.

Scripts, .env files, CI pipelines, and AI coding agents all need passwords, API keys, and tokens. Most of the time those values end up pasted into files, environment variables, or chat transcripts. Devolutions CLI keeps them in your Devolutions vault and resolves them only when a command starts, so your files hold a devo:// reference instead of the value.

Devolutions CLI is one command, devo, for Windows, macOS, and Linux. It works with Devolutions Cloud, Devolutions Server, and local Devolutions Remote Desktop Manager profiles, with the same commands for all three.

What do you want to do?

Take secrets out of my code

Replace passwords in scripts and .env files with references, and run your commands with the real values.

Give an AI agent a credential

Let Claude Code, GitHub Copilot, or another agent use a credential without the value reaching its transcript.

Use secrets in a CI pipeline

Sign in without a prompt, read JSON output, and install Devolutions CLI on your build agents from one archive.

Manage my workspace from a terminal

Work with vaults, entries, users, groups, and access in Devolutions Cloud, Devolutions Server, or a local profile.

New to Devolutions CLI?

Quick start

Five minutes from installation to a command that runs with a secret from your vault.

How Devolutions CLI works

Contexts, workspaces, and devo:// references: the three ideas behind every Devolutions CLI command.

What stays hidden, and what doesn't

Which commands keep a secret hidden, which ones hand it over, and what Devolutions CLI can't protect you from.

Have a quick question, like "Do I need Devolutions Remote Desktop Manager installed?" Check the frequently asked questions.

Something isn't working?

Start with Troubleshooting. It's organized by what you see, like "A secret reference doesn't resolve" or "Sign-in fails".