CLI reference

Every tofa subcommand documented in one place. Auto-generated synopsis and flags are kept in sync with the source by an xtask tool — they cannot drift.

Global options

These work on every subcommand:

Flag	Description
`--vault <PATH>`	Override the vault path. Reads from `TOFA_VAULT` env var as fallback.
`--help`, `-h`	Print help.
`--version`, `-V`	Print the version.

Environment variables

Variable	Effect
`TOFA_VAULT`	Default vault path when `--vault` is not given.
`TOFA_PASSPHRASE`	If set, used instead of an interactive prompt. Avoid in production — `tofa` prints a warning to stderr when it reads this.

Commands

Command	Purpose
`init`	Create a new encrypted vault.
`list`	List every account.
`code`	Print the current TOTP code for one account.
`add`	Add an account from secret, URI, or QR.
`remove`	Remove an account.
`rename`	Rename an account.
`qr`	Print a QR code for one account or all.
`rekey`	Change the vault passphrase.
`export`	Dump every account as JSON or as a list of `otpauth://` URIs.
`import`	Import from any supported file: single- or multi-QR images, migration QRs, JSON / CSV / TXT exports from other authenticators, or a zip archive of any of the above.
`scan`	Capture every connected display and import every QR visible on screen.
`cam`	Open the webcam and wait for a QR.
`completions`	Print shell completions.
`destroy`	Permanently delete the vault.