murk-cli 0.10.2

Encrypted secrets manager for developers — one file, age encryption, git-friendly
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69

# Quick start for teammates

You've been invited to a project that uses murk for secrets. Here's how to get set up.

## 1. Install murk

```bash
brew tap interrupted-inc/murk && brew install murk
```

Or: `cargo install murk-cli`, `pip install murk-secrets`, or download from [GitHub Releases](https://github.com/interrupted-inc/murk/releases).

## 2. Generate your key

```bash
murk init
```

This creates your keypair and prints 24 recovery words. **Write them down.** If you lose your key, these words are the only way to recover it.

Your key is stored in `~/.config/murk/keys/`, not in the repo.

## 3. Get authorized

Ask whoever maintains the vault to authorize you. The easiest path is GitHub — no manual key exchange:

```bash
# (run by a current recipient, not you)
murk circle authorize github:YOUR_USERNAME
```

This fetches your SSH public keys from `https://github.com/YOUR_USERNAME.keys` and adds them as recipients. murk pins the fingerprints on first authorize, so if your GitHub keys change later the next `authorize github:YOU` will flag the diff before accepting new keys.

If GitHub isn't an option, send them your raw age pubkey instead. Run `murk init` a second time in the project directory — when the vault already exists and you are not yet authorized, it prints the pubkey you need to share:

```
⚠ not authorized — share your public key to get added:
  age1…
```

They authorize it with `murk circle authorize age1… --name you@example.com`.

## 4. Pull and use secrets

Once authorized:

```bash
git pull                    # get the updated .murk file
murk ls                     # see what secrets are available
murk get DATABASE_URL       # print one secret
murk export                 # print all as shell exports
murk exec -- ./my-script.sh # run a command with secrets in env
```

## 5. Set up direnv (optional)

```bash
murk env
direnv allow
```

Now secrets are automatically loaded when you `cd` into the project.

## What to know

- **Key names are public.** Anyone with repo access can see what secrets exist (e.g. `STRIPE_KEY`). Only values are encrypted.
- **Your key is your identity.** Don't share it. Don't paste it into chat. Don't commit it.
- **Recovery phrase = your key.** If someone has your 24 words, they have your key.
- **Revocation doesn't erase history.** If you leave the team, your access to old git history remains. The team should rotate secrets after revoking you.