sink syncs secrets between a Sink environment and a local file. It authenticates with an API key and resolves the workspace, team, project and default environment from .sink.json.
Account
command
Validate an API key and remember it. Prompts for the key when it is not given;
--key - reads it from stdin. The key goes into your OS keychain, or into ~/.config/sink/config.json (mode 0600) when no keychain backend exists.command
Forget the stored credential. Leaves
.sink.json alone.command
Show the signed-in account, the API URL, where the credential is being read from, the linked project, and — when the server supports it — the workspace’s plan, seat and secret usage.
Linking
command
Write
.sink.json for the current directory. With no flags it prompts through the available workspaces, teams, projects and environments; each flag skips one prompt. --force overwrites an existing file.Listing
Sync
sink pull [environment]
Write an environment’s secrets to a local file.
When the target file already exists and the format is
dotenv, pull first shows a diff of what is about to change, then asks before overwriting. If nothing differs it says so and leaves the file alone. Files are written mode 0600, with a header naming the project and environment.
--version pins each secret to that version, not the environment to a snapshot. Secrets with fewer versions are read at their latest, and the command names them.sink diff [environment]
Compare a local file against an environment. Changes nothing.
Output marks keys as local-only (
+), differing (~) or remote-only (-), and counts the unchanged.
sink push [environment]
Send a local file up to an environment.
push refuses a file with invalid variable names, prints the create/update/delete plan with values masked, and waits for a yes. New keys are created in one bulk call, changed keys updated in another — each update minting a new version — and prunes are deleted one at a time. Without --prune, remote-only keys are listed and left alone.
sink import <provider> [environment]
Read variables out of Railway, Vercel or Render. See Import from a provider for the full walkthrough.
Omitted identifiers are prompted for from what the token can actually see. Variables the provider will not return in clear text are listed as skipped, with a reason.
Exit codes
Errors print to stderr with a leading
✗. An expired or rejected credential says so and points at sink login; a plan limit points at Settings → Billing.
Configuration and environment variables
Where the CLI keeps its state, and every variable it reads.