Skip to main content
Use this guide in Bash on macOS or Linux. It keeps record values in the child process memory instead of writing a .env file into your repository.

​
Install and sign in

Install the CLI once, then use airctrl login to save your human setup in your user profile.
The login command asks for the API URL, your personal access token, and an optional default project. It stores only the human configuration in ~/.airctrl/config.json. Run a read-only command first to confirm the selected account:

​
Run an application with record values

Pass a project ID and the command after --. The CLI reads only the records you can access, decrypts them locally, and starts the child process with those values in its environment.
The values exist only in the child process. control values are removed before the process starts. The CLI does not create or modify a .env file.

​
Use a Service Account

For unattended work, load the active Service Account credential bundle through your CI or local secret mechanism. Keep all bundle fields together; partial or mixed credentials fail before makes a request. The CLI overview lists the configuration names used by the CLI.
A Service Account can use only its assigned permissions and projects. It cannot become a human identity by adding a human configuration file.

​
Diagnose a failure

Check the exit code instead of parsing terminal prose. A non-zero result means the command did not complete.
For an access denial, verify the selected account, project, and identity. Do not retry a permission failure with a broader ID. See Errors and retries and the full CLI command reference.