Developer Portal

CLI Command Reference, Zero-Knowledge Wire Spec & REST Endpoints

Setup & First Run

Node.js / TypeScript CLI

The Obsidian CLI brings client-side AES-256-GCM, RSA-OAEP, Shamir Secret Sharing, and repository packaging directly to your command line.

1. Install & Link Globally:

cd obsidian/cli && npm install && npm link

2. View Help & Commands:

obsidian --help

Shell Tip: Always wrap URLs and public keys in quotes " " so shells do not misinterpret # or = characters.

Command Cheat Sheet (15)

Sending

Send a quick secret (burns on read)

obsidian send "my secret password"

Sending

Send secret (keeps alive, does not burn)

obsidian send "team wifi pass" --no-burn

Sending

Send a file (.env, config, private keys)

obsidian send --file ./database.env

Reading

Read & decrypt any paste link

obsidian read "https://obsidian-tawny-chi.vercel.app/pasteId#key"

Identity

Generate personal RSA-2048 identity key

obsidian key generate

Identity

Show & copy public key to share with others

obsidian key show --public

Sending

Send secret to a specific person (Asymmetric)

obsidian send "classified" --recipient "PASTE_PUBLIC_KEY_HERE"

Shamir

Create a 2-of-3 Team Quorum (Shamir SSS)

obsidian send "root password" --shares 3 --threshold 2

Shamir

Decrypt Shamir paste with 2 shards

obsidian read "<shard1_url>" --shards "<shard2_url>"

Repository

Encrypt & send an entire folder / repository

obsidian repo send ./my-app --recipient "PASTE_PUBLIC_KEY_HERE"

Repository

Download & decrypt a whole repository

obsidian repo get "https://obsidian-tawny-chi.vercel.app/repoId#asym" --output ./my-app

Shamir

Split a password locally (offline, no server)

obsidian shamir split "super-secret" --shares 3 --threshold 2

Shamir

Recombine local shards (offline, no server)

obsidian shamir combine "shard-1-..." "shard-2-..."

Config

Check current server URL

obsidian config get-url

Config

Point CLI to a deployed server

obsidian config set-url https://obsidian-tawny-chi.vercel.app

Scenario 1: Standard Symmetric Sharing

Encrypts content with client-side AES-256-GCM. Returns a share link with the key isolated in the #fragment.

# Send secret (burns on read):
obsidian send "sk_live_998822334455"

# Send from file without burning:
obsidian send --file ./secrets.env --no-burn

# Read & decrypt link:
obsidian read "https://obsidian-tawny-chi.vercel.app/pasteId#key"

Scenario 2: Asymmetric (RSA-OAEP)

Wraps AES key with recipient's public key. The URL carries #asym (0 keys in URL). Only recipient can decrypt.

# 1. Recipient generates & shows public key:
obsidian key generate
obsidian key show --public

# 2. Sender encrypts for recipient:
obsidian send "Confidential" --recipient "<SPKI_KEY>"

# 3. Recipient reads with private key:
obsidian read "https://obsidian-tawny-chi.vercel.app/pasteId#asym"

Scenario 3: Multi-Party Quorum (Shamir SSS)

Splits master key into N polynomial shards. Any K custodians combine shards to reconstruct the master secret.

# Create 2-of-3 quorum paste:
obsidian send "Root Key" --shares 3 --threshold 2

# Decrypt when holding 2 shards:
obsidian read "<shard1_url>" --shards "<shard2_url>"

Scenario 4: Whole-Repository Sharing

Securely packages, compresses (respecting .gitignore), encrypts, and downloads entire folders.

# Encrypt & send entire repository:
obsidian repo send ./my-project --recipient "<KEY>"

# Download, decrypt & extract folder:
obsidian repo get "https://obsidian-tawny-chi.vercel.app/repoId#asym" --output ./recovered