> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/quick-start.md).

# Quick start

Install Devolutions CLI, sign in to your vault, and run a command with a secret it never shows, in about five minutes.

By the end of this page, you'll run a command that receives a password from your Devolutions vault, without the password appearing in your terminal, your files, or your shell history. It takes about five minutes.

You need an account on Devolutions Cloud or Devolutions Server, or a local Devolutions Remote Desktop Manager profile, with at least one entry you can read.

{% stepper %}
{% step %}

### Install Devolutions CLI

Devolutions CLI comes as an archive for your platform. Extract it to a folder, add that folder to your `PATH`, then check that your terminal finds `devo` (`devo.exe` on Windows):

```bash
devo --help
```

Other ways to install, and the supported platforms, are in [Install Devolutions CLI](/cli/reference/installation.md).
{% endstep %}

{% step %}

### Sign in to your workspace

Save your workspace as a **context**, a name you'll use from now on. The context you sign in to becomes the current one.

{% tabs %}
{% tab title="Devolutions Cloud" %}

```bash
devo login my-cloud --cloud https://<your-organization>.devolutions.app --oauth
```

Your browser opens so you can sign in. On a computer without a browser, sign in with an application key instead: see [Sign in to Devolutions Cloud](/cli/guides/connect/devolutions-cloud.md).
{% endtab %}

{% tab title="Devolutions Server" %}

```bash
devo login my-server --server https://<your-server-address> --oauth
```

Your browser opens so you can sign in. Other sign-in methods, such as an API key or Windows authentication, are in [Sign in to Devolutions Server](/cli/guides/connect/devolutions-server.md).
{% endtab %}

{% tab title="Local profile" %}

```bash
devo login my-local --sqlite <profile-folder>
```

Replace `<profile-folder>` with the folder of the Devolutions Remote Desktop Manager profile that holds your local workspace. There's no sign-in: a local context only points at that folder.
{% endtab %}
{% endtabs %}
{% endstep %}

{% step %}

### Find the reference to a password

Ask Devolutions CLI for the references of an entry. This lists where each secret lives, never the secret itself.

```bash
devo entry references "<entry-name>" --vault-name "<vault-name>"
```

Copy the reference of the `password` field. It starts with `devo://`.

{% hint style="info" %}
Two kinds of references can appear. A **named reference** uses the workspace, vault, and entry names, so it's easy to read. A **canonical reference** (`devo://ws/…/vault/…/entry/…/field/…`) uses IDs, so it keeps working when an entry is renamed. On Devolutions Server, this command lists canonical references only. See [Find the reference to a secret](/cli/guides/secrets/find-a-reference.md).
{% endhint %}
{% endstep %}

{% step %}

### Run a command with the secret

Pass the reference to `devo secret run`. Devolutions CLI reads the password from your vault, puts it in an environment variable for that one command, and starts it. Everything after `--` is your command.

{% tabs %}
{% tab title="PowerShell" %}

```powershell
devo secret run --env-ref DEMO_SECRET=<reference> -- pwsh -NoProfile -Command 'Write-Output $env:DEMO_SECRET'
```

{% endtab %}

{% tab title="Bash" %}

```bash
devo secret run --env-ref DEMO_SECRET=<reference> -- sh -c 'echo "$DEMO_SECRET"'
```

{% endtab %}
{% endtabs %}

The command did receive the password, but the terminal shows `<concealed by Devolutions>`: Devolutions CLI hides the values it resolved in everything the command prints. When the command ends, the variable is gone. It never existed in your shell.

Replace the example with your own program, for example a database migration or a deployment script that reads its password from an environment variable.

{% hint style="warning" %}
Masking protects what the command prints, not what it does. A program that receives a secret can still write it to a file or send it somewhere. Only run programs you trust with your secrets. See [What stays hidden, and what doesn't](/cli/guides/understand/security-model.md).
{% endhint %}
{% endstep %}

{% step %}

### Check before you run (optional)

Add `--check` to make sure the command exists and that every reference is well formed, without reading any secret or starting anything:

```bash
devo secret run --check --env-ref DEMO_SECRET=<reference> -- <your-command>
```

More options, such as several secrets at once, a time limit, or a launch file, are in [Run a command with its secrets](/cli/guides/secrets/run-with-secrets.md).
{% endstep %}
{% endstepper %}

## You're done. What next?

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Clean up your .env files</strong></td><td>Keep your <code>.env</code> files in the repository, with references instead of passwords.</td><td><a href="/cli/guides/secrets/replace-env-files.md">Take the passwords out of a .env file</a></td></tr><tr><td><strong>Work safely with AI agents</strong></td><td>Let an agent run commands that need credentials, without the values reaching its transcript.</td><td><a href="/cli/guides/ai-agents/run-an-agent.md">Give an agent a credential without exposing it</a></td></tr><tr><td><strong>Automate it</strong></td><td>Sign in from a CI pipeline without a browser or a prompt.</td><td><a href="/cli/for-devops-and-administrators/automate/ci-sign-in.md">Sign in from a CI pipeline</a></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/quick-start.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.