otty / apps

All apps/Bitwarden Secrets Manager CLI

Bitwarden Secrets Manager CLI

bws

A Rust CLI for interacting with the Bitwarden Secrets Manager.

Runs as bws|macOS, Linux, Windows|bitwarden.com

Open form in Otty otty.toml

Sync rules

What travels, what stays, what never leaves

Bitwarden Secrets Manager CLI in your home directory Every rule on this page, by file

…

server_base = "https://bitwarden.example.com"

server_api = "https://bitwarden.example.com/api"

server_identity = "https://bitwarden.example.com/identity"

state_dir = "/Users/octocat/.config/bws/state"machine-local

state_opt_out = false

Each machine keeps its own copy of these.

· state/ Exclude

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/bws/otty.tomlThe file this page is generated from

id = "bws"

name = "Bitwarden Secrets Manager CLI"

homepage = "https://bitwarden.com/help/secrets-manager-cli/"

description = "A Rust CLI for interacting with the Bitwarden Secrets Manager."

icon = "SimpleIcons:bitwarden"

executables = ["bws"]

[dotfiles]

# crates/bws/src/cli.rs: DEFAULT_CONFIG_DIRECTORY = ".config/bws",

# DEFAULT_CONFIG_FILENAME = "config", and crates/bws/src/config.rs joins them

# onto the home directory (overridable with --config-file / $BWS_CONFIG_FILE).

# The same file is parsed and written with `toml`, so it is TOML with a

# [profiles.<name>] table per profile.

paths = ["~/.config/bws/config"]

# crates/bws/src/state.rs: the state directory defaults to ~/.config/bws/state

# and holds one file per access token with "authentication tokens and additional

# relevant data" (Bitwarden's Secrets Manager CLI help). Machine-bound session

# state, never something to copy to another machine.

exclude = ["~/.config/bws/state/"]

# The access token comes from $BWS_ACCESS_TOKEN or --access-token, never from

# this file; the config file holds server URLs and profile settings only.

secret = []

# Read at the start of each command.

side_effect = false

# state_dir is an absolute path to a directory on this machine (the CLI docs

# require an absolute path), so it must not follow the profile elsewhere. The

# user typed it into the profile, so it is part of how this machine is set up

# and is kept for a rebuild: backup.

[[dotfiles.machine_lines]]

file = "~/.config/bws/config"

format = "toml"

match = { key_path = ["profiles.*.state_dir"] }

scope = "backup"

[commands]

format = 1

label = "Bitwarden Secrets Manager"

description = "Read secrets and projects. Creating, editing and deleting secrets, config and access tokens are left out; pass the token through BWS_ACCESS_TOKEN rather than a flag."

quality = "ai-draft"

base = "fig:bws"

parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/bws.ts"

license = "MIT"

[[commands.subcommand]]

path = ["secret", "list"]

label = "List secrets"

description = "List the secrets this service account can access, optionally for one project."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/bws.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "project"

label = "Project ID"

description = "Limit to this project identifier."

type = "string"

position = 0

sources = ["fig"]

[[commands.subcommand.field]]

id = "output"

label = "Output format"

description = "Output format (default json)."

type = "string"

option = ["--output", "-o"]

suggestions = [{ value = "json", label = "json" }, { value = "yaml", label = "yaml" }, { value = "env", label = "env" }, { value = "table", label = "table" }, { value = "tsv", label = "tsv" }, { value = "none", label = "none" }]

sources = ["fig"]

[[commands.subcommand.task]]

id = "all"

label = "All secrets as a table"

set = { output = ["table"] }

fields = ["output"]

required = []

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["project", "output"]

[[commands.subcommand]]

path = ["secret", "get"]

label = "Get a secret"

description = "Retrieve one secret by its ID."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/bws.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "secret_id"

label = "Secret ID"

description = "ID of the secret to retrieve."

type = "string"

position = 0

min = 1

sources = ["fig"]

[[commands.subcommand.field]]

id = "output"

label = "Output format"

description = "Output format (default json)."

type = "string"

option = ["--output", "-o"]

sources = ["fig"]

[[commands.subcommand.task]]

id = "get"

label = "Get as env line"

set = { output = ["env"] }

fields = ["secret_id", "output"]

required = ["secret_id"]

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["secret_id", "output"]

[[commands.subcommand]]

path = ["project", "list"]

label = "List projects"

description = "List the projects this service account can access."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/bws.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "output"

label = "Output format"

description = "Output format (default json)."

type = "string"

option = ["--output", "-o"]

sources = ["fig"]

[[commands.subcommand.task]]

id = "table"

label = "As a table"

set = { output = ["table"] }

fields = ["output"]

required = []

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["output"]

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/bws. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these is generated from the same rules as this page. None of them splits profiles.*.state_dir for you — that part is Otty’s own sync, or a template you write by hand.