Docs — CipherDock

Documentation

The CLI is the fastest path; the HTTP API covers everything else. Server defaults to http://127.0.0.1:8765.

AuthenticationEvery endpoint except GET /health and POST /v1/auth/login requires Authorization: Bearer <token>. Login is rate-limited (30 attempts/60s per IP).

Quickstart

Start the server

One process. Set CIPHERDOCK_MASTER_KEY (or _MASTER_KEY_FILE) first.

export CIPHERDOCK_MASTER_KEY="$(python3 -c 'import secrets;print(secrets.token_urlsafe(32))')"
python -m cipherdock serve --port 8765

Log in and create a project

Exchange credentials for a 12-hour session token.

TOKEN=$(curl -s -X POST http://127.0.0.1:8765/v1/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email": "don+secrets@lifeofmorr.com", "password": "..."}' | python3 -c 'import sys,json;print(json.load(sys.stdin)["token"])')

curl -X POST http://127.0.0.1:8765/v1/projects \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"name": "webapp"}'

Set and fetch a secret

Values are envelope-encrypted at rest; only names are ever listed.

curl -X PUT "http://127.0.0.1:8765/v1/projects/webapp/secrets/STRIPE_KEY?env=staging" \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"value": "sk_live_..."}'

curl "http://127.0.0.1:8765/v1/projects/webapp/secrets/STRIPE_KEY?env=staging" \
  -H "Authorization: Bearer $TOKEN"

Hand an agent a 15-minute token
Scoped, single-environment, read-only — then inject without touching disk.
```
cipherdock agent-token webapp staging --ttl 900
cipherdock agent-exec --token $AGENT_TOKEN -- npm start
```

Your license key

Paid plans arrive as a signed license key (cd1.…) on the claim page after checkout.

Verify it offline

cipherdock license-verify 'cd1.…' prints the plan, seats, and expiry — no network call; the signature is checked against the public key embedded in the binary.

Honest semantics: keys verify offline and cannot be revoked in real time. On cancellation a key stays valid until its expiry (~13 months from issue); cancellation takes effect at renewal/reissue. Team licenses carry the seats you paid for — Team is $12/user/mo with a 5-seat minimum; the current checkout link bills one seat and the rest reconcile at onboarding (see pricing).

API reference

Method	Endpoint	What it does
GET	`/health`	Liveness. Public.
POST	`/v1/auth/login`	Email + password → 12h session token. Rate-limited.
GET/POST	`/v1/projects`	List / create projects.
GET/PUT/DELETE	`/v1/projects/{p}/secrets/{s}?env=`	List names, fetch value, set, delete.
POST	`/v1/rotate`	Run a rotation (project, env, secret, rotator, dry_run).
POST/DELETE	`/v1/tokens[/{id}]`	Mint scoped agent tokens; revoke them.
GET	`/v1/audit`	Hash-chained audit log.
POST	`/v1/migrate`	Bulk import (HCP-style JSON, kv-JSON, dotenv).
POST	`/v1/projects/{p}/grants`	Grant a user a role on a project/env.

Full reference with request/response examples ships in the repo as OPENAPI.md.