Keeper Setup

Keeper CLI Setup & Configuration

Official documentation

• Secrets Manager (KSM) - concepts, KSM CLI install, and app/device setup
• Commander CLI - concepts, install, and interactive shell
• Keeper notation - keeper:// URIs used by ksm exec and ksm interpolate (see keeper-secrets skill for usage)

Keeper provides two CLI tools. Install what you need:

Installation security

• Prefer PyPI (pip install …) so you consume the published packages with version pins in your own dependency files. That is the default path for these tools.
• Official sources only: release binaries and source live under the Keeper-Security organization on GitHub. Before running any installer or pip install from a clone, confirm the remote URL and publisher match Keeper’s official documentation; use release tags or checksums published on the release page when you need extra assurance.
• Agents must not fabricate or echo one-time tokens, master passwords, or vault field values in chat or generated scripts. Direct the user to paste or inject secrets only in their own secure terminal or secret store.

Quick Install

KSM CLI

# With OS-native keyring (recommended for workstations)
pip install keeper-secrets-manager-cli[keyring]

# Without keyring (for containers, CI/CD, headless)
pip install keeper-secrets-manager-cli

# Verify
ksm version

Binary installers (no Python required) are published for Windows, macOS, and Linux on the official Keeper-Security/secrets-manager GitHub Releases page linked from Secrets Manager CLI documentation. Download only from that release page; verify checksums or signatures when the release provides them.

Commander

pip install keepercommander

# Optional: install from a local clone of the official repository (verify remote and use a tagged release)
git clone https://github.com/Keeper-Security/Commander.git
cd Commander
git checkout <release-tag>
python -m venv venv && source venv/bin/activate
pip install -r requirements.txt && pip install -e .

# Verify
keeper version

First-Time Setup

KSM CLI Setup

You need a One-Time Access Token from a KSM Application. If you don't have one, your Keeper admin can create it via the Vault UI or Commander (see keeper-admin skill).

Provide the token via environment variable so it is not passed as a --token argument (which can show up in shell history and process listings). Official docs: Profile command / init.

# Prerequisite: export KSM_CLI_TOKEN in this shell from Vault or Commander output (see Keeper profile docs). Never paste token values into chat or committed files.
ksm profile init
# Optional: unset KSM_CLI_TOKEN when finished in this shell.

ksm secret list  # Verify access

In CI or secret managers, inject the same variable without placing the value on the command line. For containers, see also KSM_TOKEN / KSM_INI_DIR behavior in the Keeper Secrets Manager CLI documentation.

Commander Setup

keeper shell
# Enter your email, master password, and 2FA code
# Then enable persistent login:
My Vault> this-device register
My Vault> this-device persistent-login ON

Keeper Regions

Troubleshooting

What's Next

• To retrieve and inject secrets (including Keeper notation): see the keeper-secrets skill
• To manage enterprise, users, PAM: see the keeper-admin skill