CLI Reference

Commands

bwenv init

Launch the interactive setup wizard to configure secrets for the current directory.

bwenv init

Flow:

1. Detects available password manager CLIs
2. Prompts you to select a provider (Bitwarden or 1Password)
3. Authenticates with the selected provider
4. Lists folders/vaults — browse with arrow keys, search by typing
5. Previews the environment variables that will be exported
6. Generates an .envrc file and auto-approves it via direnv

Example:

$ bwenv init
? Select a provider: Bitwarden
Unlocking vault...
? Select a folder: Production API Keys
Found 12 environment variables from 5 items
Generated .envrc — secrets will load automatically via direnv

---

bwenv export

Export secrets as export KEY=VALUE lines to stdout (non-interactive).

bwenv export --provider <provider> --folder <folder>

Flags:

• --provider — bitwarden or 1password
• --folder — folder name (Bitwarden) or vault name (1Password)

Examples:

# Print export lines
bwenv export --provider bitwarden --folder "MySecrets"

# Load into current shell
eval "$(bwenv export --provider bitwarden --folder "MySecrets")"

# 1Password
eval "$(bwenv export --provider 1password --folder "Production")"

---

bwenv login

Re-authenticate with the provider configured in the current .envrc.

bwenv login

Aliases: bwenv auth

Behavior:

1. Reads the existing .envrc to detect which provider and folder are configured
2. Re-authenticates with that provider (unlock/sign in)
3. Updates the session token in .envrc
4. Auto-approves the updated .envrc via direnv

Use this when your vault session has expired — it’s faster than bwenv init because it skips provider and folder selection.

Example:

$ bwenv login
Re-authenticating with Bitwarden...
Enter master password:
Session updated in .envrc

---

bwenv logout

Lock all vaults and terminate active sessions.

bwenv logout

Behavior:

• Bitwarden — runs bw lock to lock the vault
• 1Password — runs op signout to end the session
• Shows any lingering session environment variables and how to clear them

---

bwenv status

Show a comprehensive overview of your current bwenv state.

bwenv status

Shows:

• Current directory and .envrc info (provider, folder)
• direnv installation and hook status
• Provider CLI availability and active sessions
• Relevant environment variables (masked for security)
• Current config preferences

---

bwenv config

Open the interactive settings editor.

bwenv config

Settings:

Setting	Default	Description
Show Emoji	ON	Display emoji icons in output
Show Direnv Output	OFF	Show/hide direnv’s loading/unloading messages
Show Export Summary	ON	Show the boxed summary when secrets are loaded via direnv
Auto Sync	ON	Automatically sync vault before fetching secrets (Bitwarden)

Settings persist to ~/.config/bwenv/config.json.

---

bwenv allow

Approve the .envrc file in the current directory for direnv.

bwenv allow

Equivalent to direnv allow. In TTY mode, also re-authenticates and updates the session if needed.

---

bwenv disallow

Revoke direnv approval for the .envrc in the current directory.

bwenv disallow

Equivalent to direnv revoke.

---

bwenv remove

Delete the .envrc file from the current directory.

bwenv remove

---

bwenv version

Display the version string.

bwenv version

---

bwenv help

Show usage information and available commands.

bwenv help
bwenv --help
bwenv -h

Exit Codes

• 0 — Success
• 1 — General error (authentication failure, missing dependencies, etc.)

Environment Variables

Input

Variable	Description
BW_SESSION	Bitwarden session token (auto-managed by bwenv)
OP_SERVICE_ACCOUNT_TOKEN	1Password service account token (for CI/CD)

Output

All custom fields (Bitwarden) or item fields (1Password) from the selected folder/vault become environment variables:

# After bwenv init + direnv allow:
echo $DATABASE_URL
echo $API_KEY
echo $JWT_SECRET

Generated .envrc Format

The generated .envrc contains a single eval call:

# bwenv: provider=bitwarden folder="My Secrets"
# Run bwenv login to re-authenticate if session expires
eval "$(BW_SESSION='...' bwenv export --provider bitwarden --folder 'My Secrets')"

No secrets are stored on disk (except session tokens which expire). The .envrc fetches secrets live from your vault each time direnv loads it.

Shell Aliases

Useful additions to your shell config:

alias bwl='bwenv login'
alias bws='bwenv status'
alias bwi='bwenv init'
alias bwr='bwenv remove'