Documentation
Install the egg-carton CLI, store your first secret in 60 seconds, and integrate with any script or AI agent.
Choose the installation method that fits your workflow. The Go install is the fastest way to get started if you already have Go 1.21+.
go install github.com/egg-carton/cli/cmd/egg@latest
Verify: egg --version
Install the CLI
go install github.com/egg-carton/cli/cmd/egg@latest
Log in with Google
egg login
✓ Authenticated as you@example.com
Store a secret
egg lay API_KEY sk-ant-abc123…
✓ Encrypted with fresh DEK. Stored in EggCarton.
Retrieve a secret
egg hatch API_KEY
sk-ant-abc123…
List all secrets
egg get --list
OPENAI_KEY DATABASE_URL STRIPE_SECRET API_KEY
| Command | Description |
|---|---|
egg login | Authenticate via Google OAuth — opens browser, stores token |
egg lay <name> <value> | Encrypt and store a secret with a per-secret DEK |
egg hatch <name> | Decrypt and retrieve a single secret by name |
egg get --list | List all secret names in your vault |
egg break <name> | Permanently delete a secret |
egg whoami | Show the currently authenticated user |
egg logout | Remove local auth token |
Integrate egg-carton into any script, pipeline, or AI agent. Set EGG_TOKEN once as a CI secret and call egg hatch anywhere.
export OPENAI_KEY=$(egg hatch OPENAI_KEY) export DATABASE_URL=$(egg hatch DATABASE_URL) npm run build
Your agent doesn't need IAM roles, KMS policies, or DynamoDB credentials. Egg Carton manages all of that. Just egg login and your token is ready to use in any environment.