keb
52b6257dd5
On an Azure account's group row, the Details pane now describes the account: | field | from | |---|---| | name | token `name` | | user (and "service principal") | az's account list | | tenant: name · ID | az's account list (the name is borrowed from another entry in the same tenant when az left it out) | | object ID | token `oid`; `y` on the row copies it | | sign-in: MFA or not, and how | token `amr` | | directory roles | token `wids`: built-in roles by name, others as `role 1a2b3c4d`, the default member role left out | | subs: count · default | az's account list | | cloud | az's account list, when not AzureCloud | Nothing is fetched for it: the claims are the ones from the token lazysecrets already gets for the account's own tenant, read without verification. The token itself is never stored or shown. Before the first token, only the az-list fields show. A failing account shows its sign-in problem there instead (from #4). New optional `provider.Accounts` interface; `azure.Provider` implements it. Tests: the fields from claims and az's list, sign-in methods, the UI showing it on the group row only, and `y` copying the object ID. Checked against a real signed-in account (name, MFA · password, default subscription) and an expired one (az-list fields only, since there's no token). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Karl-Einar Bergstrøm <karl-einarb@outlook.com> Reviewed-on: #5
lazysecrets
A terminal UI for finding, reading and sharing secrets. Inspired by the fantastic lazygit.
Main features
- Read-only: lazysecrets never creates, changes or deletes a secret, so
it's safe to point at production. That's by design and may stay that way.
(
eopens a repo's SOPS or.envfile in your editor, orsops edit; any change is yours.) - Zero setup: uses the logins you already have (
az, the Databricks CLI,sops,git). No config file needed. - Search everything:
ctrl+ssearches every source at once, with fzf-style matching ('exact,^prefix,suffix$,!not), and jumps straight to the result. - Share links:
scopies alazysecrets://link. A colleague opens it with their own access, from the terminal or with a click in the browser or chat. - Careful with values: values stay hidden until you reveal them, and copied values are cleared from the clipboard after 30 seconds.
- Scriptable:
lazysecrets get <link>prints a value for scripts and pipes. - Favourites: star the secrets you use most and get back to them in one key.
- Expiry warnings: secrets, keys and certificates that expire soon are marked.
- Your way: rebind any key, pick a theme, and add custom commands to run on a secret.
- Try it first:
lazysecrets --demoruns on built-in sample data. - Supported platforms: Azure Key Vault, Databricks secret scopes, and SOPS and
.envfiles in your git repos.
Early development: expect rough edges. See CHANGELOG.md for what's new.
Install
On macOS or Linux (arm64 or x86_64):
curl -fsSL https://git.kebcloud.no/keb/lazysecrets/raw/branch/main/install.sh | sh
It installs the latest release
into ~/.local/bin after checking it against the release's checksums.
sh -s -- v0.2.0 installs a given version, LAZYSECRETS_INSTALL_DIR
somewhere else.
lazysecrets looks for a newer release once a day: the footer then shows
↑ v0.2.0, and U shows its changelog and updates in place (or run
lazysecrets update).
Or build it yourself:
go install git.kebcloud.no/keb/lazysecrets/cmd/lazysecrets@latest.
Get started
az login # login with azure cli
lazysecrets # start lazysecrets
lazysecrets --demo # test with demo data
Pick a source on the left, then a vault, then a secret. The keys you'll use most:
| Key | Action |
|---|---|
j/k, h/l, enter, esc |
move, switch panes, drill in, back |
/ |
filter the list you're in |
space |
reveal / hide the value |
y |
copy the value (cleared from the clipboard after 30s) |
ctrl+s |
Go to: search everything and jump there |
f / F |
star / your favourites |
s |
copy a link to share |
? |
every key, searchable |
q |
quit |
Docs
- Keys: every key, Go to, the layout, and rebinding keys
- Azure Key Vault: accounts, permissions, pinned vaults
- Databricks: profiles and Key Vault-backed scopes
- SOPS and .env files: which repos and files, decrypting
- Links: sharing, opening,
lazysecrets getin scripts, and opening links from the browser and chat - Custom commands: run your own commands on a secret
- Config: every option, themes, layered configs, the state file
- Development: building, tests, pull requests and releasing
Privacy
lazysecrets never stores, caches or sends your secret values. It keeps the
names and metadata of what you've loaded in a cache file readable only by
you, to show it at once next time (cache: false turns it off). It talks
only to the services you use it with, and collects no usage data. The one
call of its own is a daily check for a new release on this server, which
updateCheck: false turns off.
AI disclosure
Built with help from an agentic coding assistant. Every change is requested, reviewed and tested by me before it's merged.
License
Copyright © 2026 Karl-Einar Bergstrøm.
lazysecrets is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. See LICENSE.