Personal API Key for CLI Authentication
Your Bitwarden personal API key can be used as a method for authenticating into the command line interface (CLI).
note
Your personal API key is not the same as the organization API key used to access the Bitwarden Public API or Directory Connector. Personal API keys will have a client_id
with format "user.clientId"
, while organization API keys will have a client_id
with format "organization.ClientId"
.
To get your personal API key:
In the Bitwarden web app, navigate to Settings → Security → Keys:
Select the View API key button and enter your master password to validate access. Once entered, you will be provided the following:
client_id: "user.clientId"
(This value is unique to your account and does not change.)client_secret: "clientSecret"
(This value is unique and can be rotated).scope: "api"
(This value will always be"api"
).grant_type: "client_credentials"
(This value will always be"client_credentials"
).
Select the Rotate API Key button to rotate your personal API key. Rotating your key will only change your client_secret
.
Rotating your key will invalidate your previous key and all active sessions using that key.
Logging in to the CLI with the personal API key is recommended for automated workflows or providing access to an external application. To log in with the API key:
Bashbw login --apikey
This will initiate a prompt for your personal client_id
and client_secret
. Once your session is authenticated using these values, you'll be prompted to use the unlock
command (learn more).
Using API key environment variables
In scenarios where automated work is being done with the Bitwarden CLI, you can save environment variables to prevent the need for manual intervention at authentication.
Environment variable name | Required value |
---|---|
BW_CLIENTID |
|
BW_CLIENTSECRET |
|
Suggest changes to this page
How can we improve this page for you?
For technical, billing, and product questions, please contact support