> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usesink.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart

> Install the Sink CLI, authenticate, link a project, and sync secrets.

By the end of this page a local directory is linked to a Sink project and its `.env` file is coming from Sink.

<Steps>
  <Step title="Create an account">
    Sign up at [usesink.co/auth/signup](https://usesink.co/auth/signup) with email and password, Google, or GitHub. Signing up creates your first workspace for you.
  </Step>

  <Step title="Install the CLI">
    ```bash theme={null}
    curl -fsSL https://usesink.co/install.sh | sh
    ```

    The installer reads [`/cli/manifest.json`](https://usesink.co/cli/manifest.json), verifies the wheel's checksum against it, and links `sink` into `~/.local/bin`. Because the script is served by the deployment it installs a client for, the version always matches the server.

    <Tip>
      If `sink` is not found afterwards, add `~/.local/bin` to your `PATH`.
    </Tip>
  </Step>

  <Step title="Create an API key">
    In the dashboard, open **API Keys** and create one. Keys begin with `sk-`; treat them like a password. The token is shown once, at creation.
  </Step>

  <Step title="Log in">
    ```bash theme={null}
    sink login --api-url https://usesink.co
    ```

    Paste the key when prompted. Sink stores it in your OS keychain; where no keychain backend exists it falls back to `~/.config/sink/config.json`, written readable only by you.

    ```bash theme={null}
    sink whoami
    ```

    confirms the account, the API URL and where the credential is being read from.
  </Step>

  <Step title="Link the directory">
    From the repository that should receive the secrets:

    ```bash theme={null}
    sink init
    ```

    With no flags it walks you through picking a workspace, team, project and default environment. To skip the prompts:

    ```bash theme={null}
    sink init --team Platform --project checkout-api --env prod
    ```

    This writes `.sink.json` — ids and display names, no values. It is safe to commit, and `pull`, `push` and `diff` find it by walking up from the current directory.

    ```json .sink.json theme={null}
    {
      "workspace": { "id": "86da4d20-…", "name": "Acme" },
      "team":      { "id": "975b6812-…", "name": "Platform" },
      "project":   { "id": "8017614d-…", "name": "checkout-api" },
      "environment": "prod"
    }
    ```
  </Step>

  <Step title="Sync">
    ```bash theme={null}
    sink pull            # write the linked environment to ./.env
    sink diff            # show how ./.env differs from Sink
    sink push            # send local changes up, after a confirmation
    ```

    Each command takes an optional environment name to override the linked default: `sink pull staging`.

    Files written by `pull` are created `0600`. `push` shows you the plan — creates, updates, and what it is leaving alone — and waits for a yes before writing anything.
  </Step>
</Steps>

## Bringing existing variables in

If your values currently live on a hosting provider, import them rather than copying by hand:

```bash theme={null}
sink import railway prod
sink import vercel prod --project prj_abc --provider-env production
sink import render prod --service srv_1
```

The provider token is used for that one request and is never written to disk. See [Import from a provider](/guides/importing).

## Running in CI

Don't run `sink login` in a pipeline. Set two environment variables instead:

```bash theme={null}
export SINK_API_URL=https://usesink.co
export SINK_API_KEY=sk-…
sink pull prod --force
```

`SINK_API_KEY` takes precedence over anything stored on disk or in a keychain. [Secrets in CI](/guides/ci) covers the full pattern, including drift checks.

## Next steps

<Columns cols={2}>
  <Card title="Core concepts" icon="sitemap" href="/concepts">
    What a workspace, team, project and environment each hold.
  </Card>

  <Card title="CLI reference" icon="terminal" href="/cli/reference">
    Every command and flag.
  </Card>

  <Card title="Security model" icon="shield-halved" href="/security/encryption">
    How values are encrypted, and what Sink can and cannot see.
  </Card>

  <Card title="Plans and limits" icon="gauge" href="/guides/plans">
    What each tier allows.
  </Card>
</Columns>