Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions docs/public/docs/commands/contents/secret-references.md
Original file line number Diff line number Diff line change
Expand Up @@ -65,9 +65,9 @@ pass://Work/XyZ789/password # Vault by name, item by ID
pass://AbCdEf123456/GitHub/password # Vault by ID, item by name
```

!!! note "Duplicates"

If there are several objects that match the name, one of them will be used. If you want to make sure that you are referencing a unique object, please use the specific `Share ID` and `Item ID` you want to target
> [!NOTE]
> **Duplicates**
> If there are several objects that match the name, one of them will be used. If you want to make sure that you are referencing a unique object, please use the specific `Share ID` and `Item ID` you want to target

## Field names

Expand Down
6 changes: 3 additions & 3 deletions docs/public/docs/commands/contents/view.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,9 @@ pass-cli item view [OPTIONS] [URI]

- `--share-id SHARE_ID` - Share ID of the vault containing the item
- `--vault-name VAULT_NAME` - Name of the vault containing the item
- `--item-id ITEM_ID` - ID of the item to update
- `--item-title ITEM_TITLE` - Title of the item to update
- `URI` - Secret reference in as specified in [here](secret-references.md)
- `--item-id ITEM_ID` - ID of the item to view
- `--item-title ITEM_TITLE` - Title of the item to view
- `URI` - Secret reference as specified in [here](secret-references.md)
- `--output FORMAT` - Output format: `human` (default) or `json`

**Mutually exclusive options:**
Expand Down
18 changes: 9 additions & 9 deletions docs/public/docs/commands/item.md
Original file line number Diff line number Diff line change
Expand Up @@ -172,9 +172,9 @@ When generating new SSH keys with `--password`, you'll be prompted to enter and
- `PROTON_PASS_SSH_KEY_PASSWORD` - Passphrase as plain text
- `PROTON_PASS_SSH_KEY_PASSWORD_FILE` - Path to file containing the passphrase

!!! note "Passphrase recommendation for generated keys"

Since generated SSH keys are already encrypted and securely stored within your Proton Pass vault, adding a passphrase is optional. However, if you plan to export the key for use outside Proton Pass, adding a passphrase provides an additional layer of security.
> [!NOTE]
> **Passphrase recommendation for generated keys**
> Since generated SSH keys are already encrypted and securely stored within your Proton Pass vault, adding a passphrase is optional. However, if you plan to export the key for use outside Proton Pass, adding a passphrase provides an additional layer of security.

**Examples:**

Expand Down Expand Up @@ -316,9 +316,9 @@ shred -u /tmp/id_ed25519_temp # Linux
rm -P /tmp/id_ed25519_temp # macOS
```

!!! tip "Using imported SSH keys"

Once imported, your SSH keys can be loaded into any SSH agent using the [`ssh-agent load`](./ssh-agent.md#ssh-agent-integration) command or by starting Proton Pass CLI's built-in SSH agent with [`ssh-agent start`](./ssh-agent.md#proton-pass-cli-as-your-ssh-agent).
> [!TIP]
> **Using imported SSH keys**
> Once imported, your SSH keys can be loaded into any SSH agent using the [`ssh-agent load`](./ssh-agent.md#ssh-agent-integration) command or by starting Proton Pass CLI's built-in SSH agent with [`ssh-agent start`](./ssh-agent.md#proton-pass-cli-as-your-ssh-agent).

### view

Expand Down Expand Up @@ -400,9 +400,9 @@ The `update` command allows you to modify fields of an existing item. You can up

Standard fields for login items include: `title`, `username`, `password`, `email`, `url`, `note`. You can also create or update custom fields with any name.

!!! info "Types of fields"

Item update does not allow to change time or TOTP fields. Please use a different Proton Pass client to update those fields
> [!NOTE]
> **Types of fields**
> Item update does not allow to change time or TOTP fields. Please use a different Proton Pass client to update those fields

**Examples:**

Expand Down
14 changes: 7 additions & 7 deletions docs/public/docs/commands/login.md
Original file line number Diff line number Diff line change
Expand Up @@ -26,11 +26,10 @@ In case you want to log in by using SSO, or your account is protected by a hardw

## Interactive login

!!! warning "Interactive login restrictions"
Take into account that not all login flows are supported in the Interactive login. SSO login flows, or 2FA requiring
```
a U2F key are only supported in the web login.
```
> [!WARNING]
> **Interactive login restrictions**
> Take into account that not all login flows are supported in the interactive login. SSO login flows or 2FA requiring
> a U2F key are only supported in the web login.

To log in with your Proton account directly in the CLI:

Expand Down Expand Up @@ -60,8 +59,9 @@ For each authentication parameter, the CLI checks for values in this order:

### Password

!!! warning "Password in env variables"
Storing your password in an environment variable makes it readable by all other processes under the same session. Be conscious about doing so, and clear the variable when you are done.
> [!WARNING]
> **Password in env variables**
> Storing your password in an environment variable makes it readable by all other processes under the same session. Be conscious about doing so, and clear the variable when you are done.

**Interactive (default):**

Expand Down
5 changes: 3 additions & 2 deletions docs/public/docs/commands/share.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,9 @@

Manage shares in Proton Pass.

!!! info "Sharing content in Proton Pass"
If you are looking for a way to share content in Proton Pass, please refer to the [`vault share`](./vault.md#share) and the [`item share`](./item.md#share) commands.
> [!NOTE]
> **Sharing content in Proton Pass**
> If you are looking for a way to share content in Proton Pass, please refer to the [`vault share`](./vault.md#share) and the [`item share`](./item.md#share) commands.


## Synopsis
Expand Down
13 changes: 7 additions & 6 deletions docs/public/docs/commands/ssh-agent.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# SSH Agent

The Proton Pass CLI integrates nicely with any existing SSH workflows. It can either act as a SSH agent, or load your Pass-stored SSH keys into your already existing SSH agent. Let's see how to use both modes.
The Proton Pass CLI integrates nicely with any existing SSH workflows. It can either act as an SSH agent, or load your Pass-stored SSH keys into your already existing SSH agent. Let's see how to use both modes.

## Previous considerations

Expand All @@ -14,7 +14,7 @@ Proton Pass allows you to generate new SSH keys, but it can also import and secu
If you are generating new SSH keys, there's no need to protect them with a passphrase, as they are already encrypted and securely stored within your Proton Pass vault.
However, if you are importing your already-existing SSH keys, probably they are using a passphrase for security reasons. If you want to import your passphrase-protected SSH keys, you can either:

- Create a copy of your unlocked private SSH key and import it into Proton Pass. For removing the passphrase of a SSH key you can use `ssh-keygen -p -f PATH_TO_YOUR_PRIVATE_KEY -N ""` (it will prompt your for your passphrase).
- Create a copy of your unlocked private SSH key and import it into Proton Pass. For removing the passphrase of an SSH key you can use `ssh-keygen -p -f PATH_TO_YOUR_PRIVATE_KEY -N ""` (it will prompt you for your passphrase).
- Import your passphrase-protected private SSH key into Proton Pass and also create a custom field of type Hidden containing the passphrase. You can name it `Password` or `Passphrase`, but if you save it with any other name, Proton Pass CLI will try to use all the available `Hidden` custom fields to open it.

For more details on importing passphrase-protected keys, see the [SSH key import documentation](./item.md#create-ssh-key-import).
Expand Down Expand Up @@ -74,7 +74,7 @@ You can verify with: ssh-add -l

## Proton Pass CLI as your SSH agent

Proton Pass CLI can also work as a SSH agent itself. For doing so, you can start it by running the following command:
Proton Pass CLI can also work as an SSH agent itself. For doing so, you can start it by running the following command:

```bash
pass-cli ssh-agent start
Expand All @@ -99,7 +99,7 @@ Keys will refresh automatically every 3600 seconds.
Press Ctrl+C to stop the agent.
```

When the SSH agent starts, it will create a unix socket in the default location, which is `$HOME/.ssh/proton-pass-agent.sock`. You can specify a custom location by passing the `--socket-path` flag:
When the SSH agent starts, it will create a Unix socket in the default location, which is `$HOME/.ssh/proton-pass-agent.sock`. You can specify a custom location by passing the `--socket-path` flag:

```text
pass-cli ssh-agent start --socket-path MY_CUSTOM_SOCKET_PATH
Expand All @@ -119,7 +119,8 @@ export SSH_AUTH_SOCK=/Users/youruser/.ssh/proton-pass-agent.sock

### Creating new SSH key items automatically

!!! info "Feature available since version 1.3.0"
> [!NOTE]
> **Feature available since version 1.3.0**

When using Proton Pass CLI as your SSH agent, you can enable automatic creation of new SSH key items. This feature is particularly useful if you want to import an existing SSH key using `ssh-add` and have it automatically stored in your Proton Pass vault.

Expand Down Expand Up @@ -156,7 +157,7 @@ ssh-add ~/.ssh/my_new_key

### `ssh-copy-id` fails due to having many ssh keys loaded and doesn't prompt for a password

A usual flow with a SSH agent is making sure we can log in with our SSH keys onto a new server, which is usually either done by:
A usual flow with an SSH agent is making sure we can log in with our SSH keys onto a new server, which is usually either done by:

1. The sysadmin adding our public SSH key for the desired remote user.
2. Ourselves performing a `ssh-copy-id` identifying with password for the first time in order to copy our SSH keys into the `authorized_keys` file.
Expand Down
10 changes: 6 additions & 4 deletions docs/public/docs/commands/update.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,9 @@ pass-cli update [--yes] [--set-track TRACK]

The `update` command keeps your Proton Pass CLI up to date with the latest features, improvements, and security patches. It automatically downloads and installs the newest version available for your platform. You can also use this command to switch between different release tracks (stable and beta).

!!! warning "Manual installation only"
**The `update` command and track switching only work if you installed Proton Pass CLI manually** (using the installation script or manual download). If you installed via a package manager (e.g., Homebrew), you must use that package manager's update mechanism instead. Track switching is not available for package manager installations.
> [!WARNING]
> **Manual installation only**
> **The `update` command and track switching only work if you installed Proton Pass CLI manually** (using the installation script or manual download). If you installed via a package manager (e.g., Homebrew), you must use that package manager's update mechanism instead. Track switching is not available for package manager installations.

## How to update

Expand Down Expand Up @@ -42,8 +43,9 @@ pass-cli update --yes

The Proton Pass CLI supports different release tracks, allowing you to choose between stability and early access to new features.

!!! warning "Track switching availability"
Release track switching is **only available for manual installations**. If you installed Proton Pass CLI via a package manager (e.g., Homebrew), you cannot switch tracks using the `--set-track` option.
> [!WARNING]
> **Track switching availability**
> Release track switching is **only available for manual installations**. If you installed Proton Pass CLI via a package manager (e.g., Homebrew), you cannot switch tracks using the `--set-track` option.

### Available tracks

Expand Down
20 changes: 11 additions & 9 deletions docs/public/docs/get-started/configuration.md
Original file line number Diff line number Diff line change
Expand Up @@ -65,14 +65,15 @@ To work around this limitation, the Linux keyring library is configured to store

This is a known limitation when running in headless Linux environments.

Take into account that when running in docker containers, the container cannot access the kernel secret service, so the only option available to be used when running in a container is the Filesystem storage.
Take into account that when running in Docker containers, the container cannot access the kernel secret service, so the only option available to be used when running in a container is the Filesystem storage.

### 2. Filesystem storage

!!! warning "Using the key filesystem storage"
Take into account that storing your key in the local filesystem makes the encryption key be side-by-side with the
encrypted data, which could make it easier for an attacker to get access to your data. By using this option you are
in charge of securing access to your system and your data.
> [!WARNING]
> **Using the key filesystem storage**
> Take into account that storing your key in the local filesystem makes the encryption key be side-by-side with the
> encrypted data, which could make it easier for an attacker to get access to your data. By using this option you are
> in charge of securing access to your system and your data.

**Configuration:**

Expand Down Expand Up @@ -119,9 +120,10 @@ This stores the encryption key in a file on disk:

### 3. Environment variable storage

!!! warning "Using the environment variable storage"
Take into account that storing your key in an environment variable makes it available to any other process that is under the same session / in the same container.
By using this option you are in charge of securing access to your system and your data.
> [!WARNING]
> **Using the environment variable storage**
> Take into account that storing your key in an environment variable makes it available to any other process that is under the same session / in the same container.
> By using this option you are in charge of securing access to your system and your data.

**Configuration:**

Expand All @@ -132,7 +134,7 @@ export PROTON_PASS_ENCRYPTION_KEY=your-secret-key

This derives the encryption key from the `PROTON_PASS_ENCRYPTION_KEY` environment variable, which **must be set and non-empty**.

If you are running linux or macOS, you can easily generate a safe encryption key by executing:
If you are running Linux or macOS, you can easily generate a safe encryption key by executing:

```bash
dd if=/dev/urandom bs=1 count=2048 2>/dev/null | sha256sum | awk '{print $1}'
Expand Down
24 changes: 13 additions & 11 deletions docs/public/docs/get-started/installation.md
Original file line number Diff line number Diff line change
Expand Up @@ -41,12 +41,13 @@ brew update
brew upgrade pass-cli
```

!!! warning "Installing via Homebrew"
When installed via Homebrew (or any package manager):

- **The `pass-cli update` command will not work**: you must use `brew upgrade pass-cli` instead
- **Track switching is not available**: you cannot switch between stable and beta tracks
- Updates are managed entirely by Homebrew
> [!WARNING]
> **Installing via Homebrew**
> When installed via Homebrew (or any package manager):
>
> - **The `pass-cli update` command will not work**: you must use `brew upgrade pass-cli` instead
> - **Track switching is not available**: you cannot switch between stable and beta tracks
> - Updates are managed entirely by Homebrew

## Installation options

Expand Down Expand Up @@ -89,10 +90,11 @@ Invoke-WebRequest -Uri https://proton.me/download/pass-cli/install.ps1 -OutFile
$env:PROTON_PASS_CLI_INSTALL_CHANNEL="beta"; .\install.ps1
```

!!! note "Track Switching for Manual Installations"
If you install the Pass CLI by selecting an install channel, you will automatically be switched to that release track. You can switch between tracks later or revert to the `stable` track using the [`update` command](../commands/update.md).

**Important:** Track switching is only available for manual installations. If you install via a package manager, you cannot switch tracks.
> [!NOTE]
> **Track Switching for Manual Installations**
> If you install the Pass CLI by selecting an install channel, you will automatically be switched to that release track. You can switch between tracks later or revert to the `stable` track using the [`update` command](../commands/update.md).
>
> **Important:** Track switching is only available for manual installations. If you install via a package manager, you cannot switch tracks.

## System requirements

Expand Down Expand Up @@ -151,4 +153,4 @@ You should see the version number. If you get a "command not found" error, make

## Next steps

Once installed, proceed to the [Getting started](../getting-started/login.md) guide to learn how to authenticate and configure the CLI.
Once installed, proceed to the [Getting started](../getting-started/login.md) guide to learn how to authenticate and configure the CLI.
8 changes: 4 additions & 4 deletions docs/public/docs/help/faq.md
Original file line number Diff line number Diff line change
@@ -1,19 +1,19 @@
# Frequently asked questions

## **Can I run inside a docker container?**
## **Can I run inside a Docker container?**

You can run inside docker but the application will not be able to reach any keyring to store safely any encryption key. You will need to use the local file system to store your encryption keys which is unsafe. To use the local file system:
You can run inside Docker but the application will not be able to reach any keyring to store safely any encryption key. You will need to use the local file system to store your encryption keys which is unsafe. To use the local file system:

1. Ensure you are logged out by doing `pass-cli logout --force`
2. Set the environment variable `PROTON_PASS_KEY_PROVIDER` to `fs`.
3. Login as you normally would.

## **Do you send any telemetry?**

We send anonymized telemetry that **never** includes any personal or sensitive data. It only sends what action was done (like `item created of type note` with client `X`) but **never** send any contents or anything that can be used to track any data or user. We use this information to try to make the product better.
We send anonymized telemetry that **never** includes any personal or sensitive data. It only sends what action was done (like `item created of type note` with client `X`) but **never** sends any contents or anything that can be used to track any data or user. We use this information to try to make the product better.

## **Can I disable telemetry?**

Certainly! There are many ways of disabling it. If you want to disable it for this application you can set an environment variable `PROTON_PASS_DISABLE_TELEMETRY`. If the environment variable is set telemetry will not be saved and the currently saved locally will be cleared.
Certainly! There are many ways of disabling it. If you want to disable it for this application you can set an environment variable `PROTON_PASS_DISABLE_TELEMETRY`. If the environment variable is set telemetry will not be saved and the currently saved telemetry will be cleared.

If you want to disable it globally you can go to your [Account security settings](https://account.proton.me/pass/security) and disable `Collect usage diagnostics`
6 changes: 3 additions & 3 deletions docs/public/docs/help/troubleshoot.md
Original file line number Diff line number Diff line change
Expand Up @@ -28,10 +28,10 @@ There you will be able to check the current execution policy. In order to allow
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine
```

It will only allow to run scripts that are signed, and the provided `install.ps1` is properly signed, so your computer should be able to run it without any further restrictions.
It will only allow running scripts that are signed, and the provided `install.ps1` is properly signed, so your computer should be able to run it without any further restrictions.

Once you have successfully installed it, you can set back the execution policy to its previous value by running back again the `Set-ExecutionPolicy` command and passing the original value you got by running `Get-ExecutionPolicy`.
Once you have successfully installed it, you can set back the execution policy to its previous value by running the `Set-ExecutionPolicy` command again and passing the original value you got by running `Get-ExecutionPolicy`.

## Contact support

Head to our [support form](https://proton.me/support/contact) to get help from our fantastic support team.
Head to our [support form](https://proton.me/support/contact) to get help from our fantastic support team.
Loading