Geslar CLI (the geslar command) gives scripts, automation, and AI agents access to your Vault — without a single password ever passing through their context. The value is injected directly into the process that needs it, in memory, while it runs. Available with a Premium, Family, Business, or Enterprise plan.
npm install -g @geslar/cli — needs Node.js 20+, currently the only install path for macOS. Windows and Linux also have standalone binaries (no Node.js required) — details and checksum verification are in the documentation.
geslar signin starts a device-flow login with a code you type yourself in the browser — never follow a link with the code already filled in. Full walkthrough, including the re-approval 2FA note → docs.geslar.app/cli/quickstart.
geslar unlock --ttl 30m stores a temporary, OS-encrypted grant for scripts and cron jobs with no interactive prompt; without it, commands fail closed and never guess your password. Details → docs.geslar.app/cli/quickstart.
Vault items are addressed as geslar://<vault>/<item>/<field> — the vault selected by name or a special word like personal/family/company. Full grammar, examples, and name-collision rules → docs.geslar.app/cli/reference.
geslar run resolves geslar:// references directly into the environment of the process you're launching — the CLI itself never prints or logs the value. Recommended pattern for agentic workflows and a full example → docs.geslar.app/cli/quickstart.
Online only (no local cache), macOS is npm-only for now, Alpine Linux isn't supported, and unattended automation (service accounts) is still coming. Full list → docs.geslar.app/cli/limitations.