relic

relic [command] [options]

relic is a CLI-first secret management layer that encrypts secrets on-device before transmitting them to the server. The server only stores ciphertext, ensuring zero-knowledge security.When running relic run, the CLI fetches encrypted secrets from the server, decrypts them locally using AES-256 and Argon2id, and injects them into the target process through a Rust-based runner that clears memory after use. No secrets are written to disk during injection.Relic supports team collaboration where each member's secrets are encrypted with their own keys. It also works in CI/CD pipelines using API keys set via the RELIC_API_KEY and RELIC_PASSWORD environment variables.The interactive TUI (invoked with bare relic) provides a visual interface for creating, editing, and organizing secrets across projects, environments, and folders. An MCP server mode enables integration with AI coding assistants.

login

Authenticate with Relic via browser using device authorization flow.

Clear stored authentication session, cached keys, and password.

Initialize Relic for the current project by selecting a project and writing a relic.toml config file.

List all owned and shared projects with environments and folders in a tree view.

Show the currently authenticated user's name, email, and plan.

Start the Relic MCP server for AI assistant integration.

Manage anonymous usage data collection.

Run a command with decrypted secrets injected as environment variables.

Environment name to load secrets from (required).

Folder within the environment (optional).

Scope filter: client, server, or shared (optional).

Project ID. Defaults to relic.toml or RELIC_PROJECT_ID env var.

Show version information.

Show available commands and options.

Project configuration is stored in relic.toml in the project root, containing the project ID:

$ project_id = "your-project-id"

The interactive TUI is not available in standalone binary installations; use CLI commands instead. Secrets require an active internet connection to fetch from the server, though results are cached locally for faster subsequent runs. The Rust-based runner is platform-specific and requires prebuilt binaries for each target architecture.

Relic was created by Can Vardar at Cupola as an open-source, CLI-first alternative to cloud secret managers. It is written in TypeScript (CLI) with a Rust runtime component for secure secret injection. The project is licensed under the BSL 1.1 (Business Source License) and hosted on GitHub.

doppler(1), vault(1), sops(1), age(1), gpg(1)