Configuration

Global Flags

These flags work with any command:

Flag	What it does
`-p, --password`	Pass the master password inline
`--password-file`	Read password from a file (use `-` for stdin)

Obscuro checks these sources in order and uses the first one it finds:

--password flag
--password-file flag
Configured backend (from .obscuro/config.json password_backend field):
- "keychain" → OS keychain
- "file" → ~/.config/obscuro/vaults/<hash>.pw
- "" or "none" → skipped (pre-migration vaults)
OBSCURO_PASSWORD environment variable
Interactive TTY prompt

The .obscuro/config.json file holds vault metadata (never secret values themselves). It is safe to commit.

Field	Type	Default	Description
`salt`	string	—	Base64-encoded Argon2 salt (set by `obscuro init`)
`verification_token`	string	—	Encrypted token to verify password correctness
`schema_version`	int	`0`	Config schema version (`0`=v1, `2`=v2+). Written by `obscuro auth store`.
`password_backend`	string	`""`	Which backend `getPassword` reads from: `keychain`, `file`, `none`, or `""` (skipped)

Variable	What it does
`OBSCURO_PASSWORD`	Master password (skips the interactive prompt)
`OBSCURO_NO_UPDATE_CHECK`	Set to `1` to stop update checks
`EDITOR`	Editor for `obscuro edit` (defaults to `vi`)

In automated environments there's no TTY to prompt for a password, so pass it via env var or flag:

export OBSCURO_PASSWORD="$VAULT_SECRET"
obscuro inject < manifests.yaml > decrypted.yaml

Or with a flag:

obscuro --password-file /run/secrets/obscuro-pw inject < manifests.yaml