Command line

Paw includes a full command-line interface in the same executable.

paw       # Start the desktop app
paw cli   # Run command-line operations

The CLI works with the same local vaults as the desktop app. It does not require a server, internet connection, or user account.

Basic workflow

Most CLI commands operate on unlocked vaults. Paw uses a background agent process to hold unlocked vault sessions in memory.

Start the agent (if the desktop app is not already running):
```
paw cli agent start
```
Unlock your vault in another terminal:
```
paw cli unlock Personal
```
Paw prompts for the vault password and prints a session ID:
```
Session ID: f1a2b3c4...
```
Use the session ID with commands: You can pass the session ID with --session or export it to your environment:
```
export PAW_SESSION="f1a2b3c4..."
paw cli ls Personal
```
Lock the vault when finished:
```
paw cli lock Personal
```

SSH agent integration

Paw includes an OpenSSH-compatible agent that securely serves your stored SSH keys to terminal tools like ssh and git.

When you unlock a vault with paw cli unlock, its SSH keys are automatically loaded into the agent. Set the SSH_AUTH_SOCK environment variable to connect:

export SSH_AUTH_SOCK="$HOME/.paw/agent.sock"

For complete setup instructions, Windows configuration, and verification steps, see the SSH agent documentation.

Security recommendations

Avoid typing passwords directly into command flags or shell history.
Use --clip (-c) with paw cli show to copy secrets directly to your clipboard instead of displaying them on screen.
For a complete list of commands and options, see the Command reference.