Search all skarbiec documentation

Start with existing credentials#

For a real setup, import the data you already have instead of entering it again. Create or select your vault, then use import or the Import existing items control in Desktop. The Import existing items page explains formats, conflicts, retained source fields and attachments.

Shell

skarbiec init "Your Name <you@example.com>"
skarbiec onboarding --import account.1pux --format 1password

Optional one-use capability walkthrough#

From a source checkout with skarbiec installed. The script stores only the literal non-secret value not-a-secret and refuses to overwrite an existing demo directory.

Create a vault and an item.
Register demo-workload for exactly demo-note#value, with no standing bearer.
Sign a timestamped, nonced acquisition request with the workload key.
Consume the issued capability once.
Retry the same capability and receive unauthorized.
Print the matching audit records.

Shell

SKARBIEC_EXAMPLE_DIR="${TMPDIR:-/tmp}/skarbiec-acquisition-quickstart" \
  sh docs/examples/acquire-one-field.sh

What success looks like#

Setup commands print JSON. The decisive first read returns the field once; replaying the same bearer is refused.

First acquisition-read

{
  "consumer": "demo-workload",
  "field": "value",
  "item": "demo-note",
  "ok": true,
  "value": "not-a-secret"
}

Replay of the same capability

{
  "error": "unauthorized",
  "ok": false
}

What the audit shows#

The registration output has workload_bound: true, token: null, and one exact acquire capability. The final audit query contains acquisition-issued and acquisition-consumed; it never contains the field value, signature, public key, or one-use token.

Cleanup#

Shell

rm -rf "${TMPDIR:-/tmp}/skarbiec-acquisition-quickstart"