Quickstart: CLI & SDK

This guide walks a developer through installing the QuantPass CLI and SDK, authenticating with post-quantum credentials, retrieving your first secret, and integrating QuantPass into a GitHub Actions workflow.

Prerequisites

  • A QuantPass account with at least one vault item saved. See the Browser Extension Quickstart if you haven't set one up yet.
  • Node.js 18 or later.
  • npm or pnpm.

Step 1 — Install the CLI

Install the QuantPass CLI globally:
bash
npm install -g @quantcert/cli
Verify the installation:
bash
qp --version
You should see output like @quantcert/cli 1.0.0.

Step 2 — Authenticate

Authenticate the CLI with your QuantPass account:
qp auth login
This will open a browser window to complete the authentication handshake using your Dilithium2 keypair. Once complete, the CLI stores a time-limited verified token locally. You will see:
✓ Authenticated as you@yourcompany.com
✓ Session secured via ML-DSA-44
To verify your session is active:
qp auth status

Step 3 — Retrieve Your First Secret

List the items in your default vault:
bash
qp vault list
Retrieve a specific secret by its name:
bash
qp secret get DB_PASSWORD
Output:
  • Authenticated via ML-DSA-44
  • secret: s3cr3tP@ssw0rd
  • logged to sudit trail
All secret access is logged to your QuantPass audit trail with a timestamp, your user identity, and the cryptographic algorithm used for authentication. This makes every qp secret get call SOC 2-auditable by default.

Step 4 — Install the SDK

For programmatic access from your application code:
bash
npm install @quantcert/sdk
Or with pnpm:
bash
pnpm add @quantcert/sdk

Basic Usage

typescript
import { QuantPassClient } from '@quantcert/sdk';

const client = new QuantPassClient({
  apiUrl: 'https://api.quantcert.ai',
});

// Authenticate using a machine identity token
await client.auth.login({
  userId: process.env.QP_USER_ID,
  privateKeyBase64: process.env.QP_PRIVATE_KEY,
});

// Retrieve a secret
const secret = await client.vault.getSecret('DB_PASSWORD');
console.log(secret.value);
Environment variables are the recommended way to pass your machine identity credentials. Never commit QP_PRIVATE_KEY to source control.

Step 5 — GitHub Actions Integration

QuantPass integrates with GitHub Actions to inject secrets directly into your CI/CD pipeline without storing them as GitHub Secrets.

Add QuantPass Credentials to GitHub

In your repository, go to Settings → Secrets and variables → Actions and add:
  • QP_USER_ID — your QuantPass machine identity user ID
  • QP_PRIVATE_KEY — the base64-encoded Dilithium2 private key for your machine identity
To generate a machine identity for CI/CD use, go to the QuantPass Admin Console → Developer → Machine Credentials → New Credential.

Example Workflow

name: Deploy

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install QuantPass CLI
        run: npm install -g @quantcert/cli

      - name: Authenticate with QuantPass
        run: qp auth login --machine
        env:
          QP_USER_ID: ${{ secrets.QP_USER_ID }}
          QP_PRIVATE_KEY: ${{ secrets.QP_PRIVATE_KEY }}

      - name: Inject secrets
        run: |
          export DB_PASSWORD=$(qp secret get DB_PASSWORD)
          export API_KEY=$(qp secret get STRIPE_API_KEY)
        env:
          QP_USER_ID: ${{ secrets.QP_USER_ID }}

      - name: Deploy
        run: ./deploy.sh
All secret retrievals in the workflow are logged to the QuantPass audit trail with the machine identity, timestamp, and ML-DSA-44 signature — giving your security team full visibility into what CI/CD accessed and when.

What's Next?

  • Rotate credentials automatically — use qp secret rotate DB_PASSWORD to trigger automated rotation. QuantPass updates the secret and notifies any connected systems via webhook.
  • SSH key management — store and retrieve SSH keys with qp ssh get my-key for secure, audited access to servers and infrastructure.
  • Ephemeral credentials — request time-limited credentials with qp secret get --ttl 3600 PROD_DB_PASSWORD for just-in-time access patterns.
  • Full API reference — see the Events API and Vault API documentation for the complete REST API.