fnox

Version: 1.43.0

• Usage: fnox [FLAGS] <SUBCOMMAND>

Load secrets from encrypted files, password managers, and cloud secret stores

fnox reads fnox.toml from the current directory and its parents, resolves each secret through the provider it names, and hands the values to your shell or to the command you run.

Commands by task:

• Read and run: get, list, exec, env, export, check
• Store and migrate: set, remove, import, sync, reencrypt, edit
• Configure: init, provider, plugin, profiles, config-files
• Shell and tools: activate, deactivate, completion, tui, mcp
• Diagnose: doctor, scan
• Cache and broker: daemon, lease, proxy

Put fnox options before the -- that starts a child command, as in fnox -P prod exec -- npm start. Everything after -- belongs to the child command.

Global Flags

• -c --config <CONFIG> — Config file to load

  The bare names fnox.toml, .fnox.toml, fnox.local.toml, and .fnox.local.toml search the current directory and its parents. Any other path, such as ./fnox.toml, loads only that file, its imports, and the global config.

  Default: fnox.toml

• -P --profile <PROFILE> — Profile to use; repeat or comma-separate to layer several

  Later profiles override earlier ones. Defaults to FNOX_PROFILE, then default.

• -v --verbose — Print debug logs to stderr

• --if-missing <IF_MISSING> — Override if_missing for every secret: error, warn, or ignore

  Takes precedence over FNOX_IF_MISSING and every if_missing value in the config.

• --no-color — Disable colored output

• --no-daemon — Resolve secrets directly instead of through the daemon

• --no-defaults — Use only the selected profile's secrets, without top-level [secrets]

• --non-interactive — Never prompt or open a browser; use only cached or non-interactive auth

  Environment Variable: FNOX_NON_INTERACTIVE

• --write-profile <WRITE_PROFILE> — Profile that write commands modify when several profiles are active

  Applies to set, remove, import, sync, and provider add|remove. Required when more than one profile is active; otherwise defaults to the active profile.

Flags

• -h --help — Print help
• -V --version — Print version

Subcommands

• fnox activate [--no-hook-env] [SHELL]
• fnox audit [FLAGS]
• fnox check [-a --all]
• fnox completion <SHELL>
• fnox config-files
• fnox daemon <SUBCOMMAND>
• fnox daemon clear [KEYS]…
• fnox daemon start
• fnox daemon status
• fnox daemon stop
• fnox deactivate
• fnox doctor
• fnox edit [KEY]
• fnox env [FLAGS]
• fnox exec [FLAGS] [COMMAND]…
• fnox export [FLAGS] [KEY]…
• fnox get [--base64-decode] [--refresh] <KEY>
• fnox import <FLAGS> [FORMAT]
• fnox init [FLAGS]
• fnox lease [SUBCOMMAND]
• fnox lease cleanup
• fnox lease create [FLAGS] [BACKEND_NAME]
• fnox lease list [FLAGS]
• fnox lease revoke [-a --all] [TARGET]
• fnox list [FLAGS]
• fnox mcp
• fnox plugin [SUBCOMMAND]
• fnox plugin install [-f --force] [NAME] [SOURCE]
• fnox plugin link [-f --force] <NAME> <PATH>
• fnox plugin ls
• fnox plugin uninstall <NAME>
• fnox plugin update [NAMES]…
• fnox profiles
• fnox provider [SUBCOMMAND]
• fnox provider add [FLAGS] <PROVIDER> <PROVIDER_TYPE>
• fnox provider list
• fnox provider remove [-g --global] <PROVIDER>
• fnox provider test [-a --all] [PROVIDER]
• fnox proxy <SUBCOMMAND>
• fnox proxy rules
• fnox proxy run [--no-sandbox] [--sandbox] [COMMAND]…
• fnox reencrypt [FLAGS] [KEYS]…
• fnox remove [-g --global] [-n --dry-run] <KEY>
• fnox scan [FLAGS] [DIR]
• fnox set [FLAGS] <KEY> [VALUE]
• fnox sponsors
• fnox sync [FLAGS] [KEYS]…
• fnox tui
• fnox version

Configuration

• Settings

Examples

Create a config in the current directory

fnox init

Store a secret (prompts for the value)

fnox set DATABASE_URL

Run a command with secrets in its environment

fnox exec -- npm start

List the secrets in another profile

fnox -P staging list

See also

• Quick start
• Configuration reference