CLI reference

Every tofa subcommand documented in one place. Auto-generated synopsis and flags are kept in sync with the source by an xtask tool — they cannot drift.

Global options

These work on every subcommand:

FlagDescription
--vault <PATH>Override the vault path. Reads from TOFA_VAULT env var as fallback.
--help, -hPrint help.
--version, -VPrint the version.

Environment variables

VariableEffect
TOFA_VAULTDefault vault path when --vault is not given.
TOFA_PASSPHRASEIf set, used instead of an interactive prompt. Avoid in production — tofa prints a warning to stderr when it reads this.

Commands

CommandPurpose
initCreate a new encrypted vault.
listList every account.
codePrint the current TOTP code for one account.
addAdd an account from secret, URI, or QR.
removeRemove an account.
renameRename an account.
qrPrint a QR code for one account or all.
rekeyChange the vault passphrase.
exportDump every account as JSON.
importImport from JSON or a migration QR.
scanCapture the screen and read a visible QR.
camOpen the webcam and wait for a QR.
completionsPrint shell completions.
destroyPermanently delete the vault.