Tutorials

CoreLink CLI Quickstart: Install, Authenticate, Store Your First Secret

Time: 10 minutes Difficulty: Beginner Tools: Web UI, CLI
Outcome. You'll have the tbcl-cli installed and authenticated against your CoreLink tenant, and you'll create + read your first secret from the command line.

Prerequisites

Step 1 — Install the CLI

The fastest path on macOS or Linux is the one-liner install script. It detects your OS and architecture, fetches the latest version from the registry, verifies the SHA-256 checksum, and installs to /usr/local/bin:

curl -fsSL https://usecorelink.com/install.sh | sh

If you prefer to download manually (or you're on Windows), go to the registry, click the download for your platform, extract the archive, and move tbcl-cli onto your PATH:

# macOS / Linux
tar xzf ~/Downloads/corelink-cli-*.tar.gz
sudo install -m 0755 tbcl-cli /usr/local/bin/tbcl-cli

# Windows (PowerShell)
Expand-Archive -Path "$env:USERPROFILE\Downloads\corelink-cli-*.zip" -DestinationPath "$env:USERPROFILE\.corelink"
$env:Path += ";$env:USERPROFILE\.corelink"

Confirm the install worked:

tbcl-cli --version
# secrets version v1.0.0

Step 2 — Authenticate

The default login flow opens your browser, lets you approve from your existing CoreLink session, and writes the resulting JWT to ~/.secrets-cli.yaml:

tbcl-cli login --api-url https://usecorelink.com

You'll see something like:

Opening browser to authorize this CLI.
If the browser does not open automatically, visit:
  https://usecorelink.com/cli/authorize?redirect_uri=...

Authenticated as [email protected] (token expires in 900s)

Behind the scenes the CLI binds a random localhost port, sends you to a consent page, receives a one-time code on its callback, and exchanges that code (with a PKCE verifier) for a JWT. The browser tab can be closed once you see the "Signed in" confirmation.

For CI / automation

Headless environments don't have a browser, so authenticate as a Non-Human Identity. Mint a one-time bootstrap credential in the web UI under NHI, then exchange it:

tbcl-cli login --api-url https://usecorelink.com --nhi-bootstrap snb_xxxxxxxxxxxxxxxxxxxxxx

Or, if you already have a long-lived sni_ token:

SECRETS_TOKEN=sni_xxxxxxxxxxxx tbcl-cli login --api-url https://usecorelink.com

Step 3 — Note your workspace and environment IDs

Every secret in CoreLink lives in a workspace and is tagged to an environment (dev, staging, prod, etc.). The CLI's secrets create command requires both IDs, so grab them from the web UI before you continue.

In the CoreLink UI:

  1. Sign in at usecorelink.com/login.
  2. Navigate to Secrets. The URL will look like /tenant/secrets?workspace=<workspace-id>. Copy the workspace UUID.
  3. Click into any environment (or create one under Settings → Environments if none exist). Copy the environment UUID from the URL.

Export them so the next steps are readable:

export TBCL_WS=0a7f1234-abcd-4ef0-9012-b3e1c2d3e4f5
export TBCL_ENV=9c11abcd-5678-4f82-8901-234567890abc

Step 4 — Create your first secret

tbcl-cli secrets create \
    --workspace "$TBCL_WS" \
    --environment "$TBCL_ENV" \
    --name my-first-secret \
    --value "hello world"

Expected output:

Secret created
  ID:          4a9f1234-abcd-4ef0-9012-b3e1c2d3e4f5
  Name:        my-first-secret
  Workspace:   0a7f1234-abcd-4ef0-9012-b3e1c2d3e4f5
  Environment: 9c11abcd-5678-4f82-8901-234567890abc
  Version:     1
  Created:     2026-04-24T14:32:11Z

A few things happened under the hood in that single command: CoreLink generated a fresh data encryption key (DEK), encrypted hello world with AES-256-GCM, encrypted the DEK with your workspace's KMS-held key encryption key (KEK), and stored (ciphertext, encrypted_dek) in the secrets table. The plaintext never hit disk. We wrote about the envelope encryption pattern in detail on the blog.

Copy the ID from the output — you'll use it in Step 5.

Step 5 — List and read the secret

List every secret in the current workspace to confirm yours is there:

tbcl-cli secrets list --workspace "$TBCL_WS"
# ID                                    NAME              TYPE           VERSION  UPDATED
# 4a9f1234-abcd-4ef0-9012-b3e1c2d3e4f5  my-first-secret   static_secret  1        2026-04-24T14:32:11Z

Fetch the decrypted value by ID:

tbcl-cli secrets get 4a9f1234-abcd-4ef0-9012-b3e1c2d3e4f5 --value
# hello world

Or, skip the list and look it up by (workspace, name) directly. --workspace accepts a UUID, the workspace's slug (e.g. my-team), or its display name. Quote the value if the display name contains spaces:

tbcl-cli secrets get --workspace "$TBCL_WS" --name my-first-secret --value
# by slug:
tbcl-cli secrets get --workspace my-team --name my-first-secret --value
# by display name (quote when it contains spaces):
tbcl-cli secrets get --workspace "Tenant Vault" --name my-first-secret --value
# hello world

If you see hello world, the round-trip works and your CLI session is healthy.

Verify

Three things you should confirm:

  1. tbcl-cli --version runs without error.
  2. ~/.tbcl/config exists with mode 0600 and your saved session.
  3. tbcl-cli secrets get <id> --value prints the decrypted value, confirming the full encrypt → store → retrieve → decrypt path works.

Next steps