Docs menu

Every command

Every secretbase command, as secretbase help shows it, in its groups. Add --help to a command to see only its own lines, and --json before it for output a program can read. Words in angle brackets are yours to fill in; square brackets mark what you may leave out.

Publish

  • secretbase publish [--name <name>] <folder, page.html or site.zip> · secretbase preview
  • secretbase publish [--ref <branch or tag>] [--name <name>] <https git link> — e.g. https://github.com/<you>/my-app: fetched here; publish the link again to put its newest commit online
  • secretbase new <name> — an app with no code yet: set its size, database, keys and tokens first; it gets its address when you first publish it
  • secretbase publish <folder, page.html, site.zip or https git link> --app <app> — into that app: its first code, or new code from anywhere in place of its old; it keeps its address, password, keys and database
  • secretbase publish <folder, page.html, site.zip or https git link> --new — a new app, even when one of yours has its name; without --app or --new, a publish named like one of your apps asks whether to update it
  • secretbase undo [<app>] — put an app's previous release back online; default: this folder's; with --to <name>: on that server
  • secretbase updates [<app>] on|off — an app from a git link: publish each new commit by itself; on at first
  • secretbase git-token add <host> --app <app> · secretbase git-token list · secretbase git-token remove --app <app> — an app's own token for its private repository, e.g. on github.com; it asks for the token, which never goes on the command line
  • secretbase notice · secretbase notice accept

Apps

  • secretbase status · secretbase events [--since <seq>]
  • secretbase offline [<app>] · secretbase online [<app>] — take an app offline / put it back; default: this folder's
  • secretbase delete [--yes] [<app>] — remove an app for good: its address and its data here; your folder is kept; its backups stay until secretbase backups remove <app>
  • secretbase logs [<app>] [--tail <n>] · secretbase logs selftest [--tail <n>] — an app's build and app output; default: this folder's
  • secretbase jobs [<app>] — an app's scheduled jobs from its secretbase.json: schedule, next run, last run, last exit; times in UTC
  • secretbase keys list · secretbase keys set <NAME> [--public] · secretbase keys remove <NAME> — an app's keys, in its environment; each may add --app <app>, default this folder's; it asks for the value, which never goes on the command line; --public: also put into the website code your visitors download, only for a value meant to be seen, like a publishable key; recommended: leave it off, so the key stays private
  • secretbase password on · secretbase password off
  • secretbase domain <domain> [<app>] — put an app on your own domain, e.g. example.com, through your Cloudflare account
  • secretbase domain list [<app>] · secretbase domain approve <domain> [<app>] · secretbase domain approve --tunnel <tunnel>
  • secretbase domain remove [--yes] <app> <domain> — take a domain off an app: only the record and route made for it go
  • secretbase tailscale off [<app>] · secretbase tailscale on [<app>] — an app's Tailscale address; off only while its own domain is live
  • secretbase resources [<app>] [small|standard|large] [--cpus N] [--memory 1g] [--disk 8g] [--copies N | --copies LEAST-MOST] — an app's CPU, memory, disk, copies
  • secretbase resources default [small|standard|large|--cpus …] — what new apps get
  • secretbase database [<app>] [postgres|redis on|off] — an app's own Postgres or Redis; it gets DATABASE_URL or REDIS_URL; postgis on: its Postgres with PostGIS, for maps and places
  • secretbase db connect <app> [--port N] — an app's own Postgres at an address on 127.0.0.1 here, for psql, Prisma, Drizzle or supabase db push; open until Ctrl-C
  • secretbase backend [<app>] [on|off] — Backend: sign-in, the Data API and file storage for an app or website at its own address; an app's Postgres becomes Supabase's, with its data and the same DATABASE_URL; off keeps that database; recommended: off until the app uses supabase-js
  • secretbase backend [<app>] keys [--show-secret] · secretbase backend [<app>] keys rotate publishable|secret|s3 — supabase-js's URL and the app's publishable key, and the S3 endpoint; the secret key and S3 keys only when asked; rotate makes a new one and the old one stops
  • secretbase backend [<app>] storage [on|off] — file storage: the app's uploads and image resizing, on this server; it starts by itself on the app's first upload; off stops it, its files kept, until on; recommended: leave it to start by itself
  • secretbase backend [<app>] realtime [on|off] — live updates: supabase-js's channels, with broadcast, presence and database changes, at the app's address; about 256 MB more memory while on; recommended: off until the app uses channels
  • secretbase backend [<app>] functions [on|off] — functions: the app's supabase/functions on Supabase's Deno runtime, for supabase-js's functions.invoke() at the app's address; about 64 MB more memory while on; recommended: off until the app has supabase/functions
  • secretbase backend [<app>] studio [--port N] — Supabase's Studio for the app on this computer's 127.0.0.1:54323, until Ctrl-C: its tables, SQL, users and files; it starts when you first open it and stops after 30 minutes unused; no memory reserved
  • secretbase backend [<app>] import — bring an app on hosted Supabase across into this one's empty Backend: its tables and data, its sign-in users with their passwords, and with its secret key its files and sign-in settings; asks for Supabase's connection string and key, never on the command line
  • secretbase backend [<app>] auth [confirm-email on|off | redirect add|remove <url> | redirect list | google|github on|off] — sign-in for the app: its mail, confirm-email (recommended: on), redirects, Google and GitHub; on asks for the provider's client ID and secret and prints the callback URL to register
  • secretbase shield <app> on|off · secretbase blocked <app> · secretbase unblock <app> <address> — the bot shield, on at first; recommended: on. A visitor who looks for hidden files or keeps failing to sign in is blocked from the app for a while; blocked lists them, unblock lets one back in
  • secretbase host-service <app> <address:port> · secretbase host-service <app> off — let an app reach one service on this computer or your network, e.g. a database at 192.168.1.10:5432; off at first; only the app's owner, on this computer; recommended: off unless the app needs it
  • secretbase lan on [--address <ip>] [--domain <name> [--cert <file> --key <file>]] [--main <app>] · secretbase lan off · secretbase lan status · secretbase lan ca — every app on this computer's network address over HTTPS, for computers on your network: the main app on 443, the others on 8443, 8444…; this computer's own certificate authority, whose certificate lan ca prints, or your own certificate; off at first; on this computer only
  • secretbase lan mount <app> <path> 127.0.0.1:<port> [--strip] · secretbase lan unmount <app> <path> — serve a program on this computer under a path of an app's LAN address, e.g. map tiles at /globe; the path kept, or taken off with --strip

Backups

  • secretbase backups [<app>] · secretbase backups check [<app>] — what an app's backups protect against, whether they work, the list
  • secretbase backups remove <app> [--yes] — an app you deleted: remove its backups at every place; asks first
  • secretbase backup [<app>] · secretbase restore [<app>] [--backup <id>] [--yes] — back up now / put back an app's data; same address
  • secretbase protection [<app>] [on|off] [--places all|<id>,…] — an app's nightly backups and where they go
  • secretbase places · secretbase places add <folder> · secretbase places add-bucket · secretbase places add-machine <name> · secretbase places remove <id> — where backups go: a USB drive, another disk, a storage bucket you own, a machine you paired; it asks for the bucket's secret, which never goes on the command line
  • secretbase recovery-key — the key that opens your backups; keep it somewhere other than this computer
  • secretbase recovery-key enter · secretbase restore --list · secretbase restore --from <backup id or app name> [--name <name>] [--yes] — a new computer: type the old one's recovery key, see its apps' backups, bring one back here

AI tools & tokens

  • secretbase mcp [--agent <id>] · secretbase agents add claude-code
  • secretbase agents prompt — a prompt to paste into any AI tool on this computer: it connects itself to secretbase
  • secretbase tokens · secretbase tokens create --name <name> · secretbase tokens revoke <name> — access tokens, listed under Server and App: deploy here from other computers
  • secretbase tokens create --name <name> --app <app> [--app <app>] — an App token: it reaches only those apps; read or full; recommended for one app
  • secretbase tokens create --name <name> --codev [--apps <N>] [--memory <size>] — an App token, co-developer: it makes its own apps and fully runs them
  • secretbase tokens create --name <name> --server [--ask-first] [--expires 1d|7d|30d|90d|never] — a Server token, full control: everything from anywhere; --ask-first: it asks you before deleting or making apps public; 30d if not given
  • secretbase tokens create --name <name> --server --limit read|deploy|admin [--expires 1d|7d|30d|90d|never] — a Server token limited to read, deploy or admin: every app; recommended: deploy; never: admin only
  • secretbase tokens create --name <name> --origin <https://site> — a token a web page on that site can use; up to 5 --origin
  • secretbase tokens create --name <name> --scope read|deploy|admin --expires 1d|7d|30d|90d|never — the older form of --server --limit; deploy for 90d if not given; never: admin only
  • secretbase tokens create --name <name> --master [--ask-first] [--expires 1d|7d|30d|90d|never] — the same as --server: a Server token, full control
  • secretbase tokens revoked [--dismiss] — the tokens and connected apps the 1.0.13 update revoked; --dismiss: status stops saying so
  • secretbase approvals · secretbase approve <id> · secretbase refuse <id> — what is waiting for you: an AI tool's request to delete an app or make a new app public; approve or refuse it as yourself
  • secretbase activity [--since 1h|1d|7d] [--token <name>] — what AI tools did here, newest first, and how to undo it

Machines

  • secretbase machines · secretbase machines add · secretbase machines join <address> <code> — your other secretbase machines: pair them, see all their apps
  • secretbase machines remove <name> · secretbase machines elsewhere <name> on|off
  • secretbase machines pairing on|off — off: this computer takes no new machines; on the computer only
  • secretbase health [<app>] — this machine's CPU, memory, disk and temperature now, its highest in the last 24 hours, how many more apps fit, what each app is allocated (reserved: the memory set aside for it, which decides whether another app fits) and its CPU and memory now; <app>: only that app
  • secretbase publish|status|logs|delete|offline|online|backups|backup|restore … --on <machine|any> — run it on a paired machine; any: where the app already is, else one with a free address and the most free memory
  • secretbase update --all — this computer and every paired machine, each from its own site; shows each machine's result

This computer

  • secretbase open [--print] — the dashboard in your browser; --print: an address to paste into a running browser; with --json, paste_url works once, within a minute; don't share it
  • secretbase dashboard · secretbase dashboard on · secretbase dashboard off — this dashboard from any browser, with a username and password
  • secretbase dashboard domain <name> · secretbase dashboard domain --remove · secretbase dashboard domain approve <name> — the online dashboard and the AI address on your own domain, through Cloudflare
  • secretbase update — this computer to the newest genuine release from the site it was installed from; it restarts once
  • secretbase notify — desktop notifications when an app keeps crashing, a backup fails or the disk fills; starts at login
  • secretbase email · secretbase email set [--to <address>] · secretbase email test · secretbase email off — alerts by email through your own Resend account; set asks for its key, which never goes on the command line
  • secretbase email domain · secretbase email domain add <domain> · secretbase email domain remove <domain> — send from your own domain: add shows the DNS records to add where its DNS is; email domain checks them and shows what is still missing
  • secretbase email domain --app <app> [<domain>|--clear] — the verified domain the app's own email goes from: shows it, sets it, or clears the choice; with two or more verified domains each app needs one
  • secretbase alerts · secretbase alerts test · secretbase alerts <kind> on|off — what is wrong now and what was fixed lately; which kinds are emailed: crash, start (after a restart), backup, place (a backup place), disk, key (the Tailscale sign-in), update
  • secretbase alert send [--level error|warning|info] <line> — email one line to the alert address now, for your own scripts on this computer; error when no level is given; exits 1 when it wasn't sent
  • secretbase watch status · secretbase watch on · secretbase watch off — an email when this computer stops answering, from a small checker in your own Cloudflare account, a Cloudflare Worker, that asks it every minute; needs Cloudflare, email and the online dashboard
  • secretbase frontdoor · secretbase frontdoor setup · secretbase frontdoor signout <provider>
  • secretbase cloudflare connect · secretbase cloudflare disconnect — your own Cloudflare account, once per computer
  • secretbase tailscale-key — a reusable Tailscale key: every new app gets its own address; again to renew it

From a laptop (no secretbase-daemon needed there)

  • secretbase remote add <name> <address> — a home server: its address; it asks for the token secretbase tokens create made there at a hidden prompt, or reads it from stdin
  • secretbase remote list · secretbase remote remove <name>
  • secretbase publish [--name <name>] <folder, page.html or site.zip> [--app <app>] --to <name> — publish on that server; --app: into that app there
  • secretbase publish [--ref <branch or tag>] [--name <name>] <https git link> [--app <app>] --to <name> — that server fetches it; --app: points that app there at the link and branch
  • secretbase new <name> --to <name> — an app with no code there yet
  • secretbase tokens · secretbase tokens create --name <name> --app <app> [--scope read|full] [--expires 1d|7d|30d|90d] · secretbase tokens revoke <name> — each with --to <name>: tokens for your apps there, for other devs
  • secretbase git-token add <host> --app <app> · secretbase git-token list · secretbase git-token remove --app <app> — each with --to <name>: an app's own token for its private repository there; it asks for the token, never on the command line
  • secretbase keys list · secretbase keys set <NAME> [--public] · secretbase keys remove <NAME> — each with [--app <app>] --to <name>: the app's keys there; it asks for the value, which never goes on the command line; --public: also put into the website code, only for a value meant to be seen; recommended: leave it off
  • secretbase backups [<app>] · secretbase backups check [<app>] · secretbase backup [<app>] · secretbase protection [<app>] [on|off] — each with --to <name>: that app's backups there: what they protect against, the last check, back up now
  • secretbase restore [<app>] [--backup <id>] [--yes] --to <name> — put back an app's data there; it asks first unless --yes
  • secretbase places · secretbase places add-bucket [--endpoint <address>] [--bucket <name>] [--prefix <folder>] [--region <region>] [--access-key-id <id>] · secretbase places add-machine <name> — each with --to <name>: that server's backup places; it asks for the bucket's secret, never on the command line; a disk is added there itself
  • secretbase database [<app>] [postgres|redis|postgis on|off] --to <name> — the app's own Postgres, Redis or PostGIS there
  • secretbase db connect <app> [--port N] --to <name> — the app's own Postgres there on this computer's 127.0.0.1, for psql, Prisma, Drizzle or supabase db push; open until Ctrl-C
  • secretbase backend [<app>] [on|off] · secretbase backend [<app>] keys [--show-secret] · secretbase backend [<app>] keys rotate publishable|secret|s3 · secretbase backend [<app>] auth [confirm-email on|off | redirect add|remove <url> | redirect list | google|github on|off] · secretbase backend [<app>] storage [on|off] · secretbase backend [<app>] realtime [on|off] · secretbase backend [<app>] functions [on|off] · secretbase backend [<app>] studio [--port N] · secretbase backend [<app>] import — each with --to <name>: an app's or website's Backend there: on or off (recommended: off until the app uses supabase-js), its URL and keys, sign-in, file storage, live updates, functions, Studio on this computer's 127.0.0.1, an app on hosted Supabase brought into it; a provider's client ID and secret, Supabase's connection string and key are asked for, never on the command line
  • secretbase status · secretbase logs [<app>] [--tail <n>] · secretbase delete [--yes] <app> · secretbase offline <app> · secretbase online <app> — each with --to <name>
  • secretbase undo <app> --to <name> — put the app's previous release back online there
  • secretbase jobs [<app>] --to <name> — an app's scheduled jobs there: schedule, next run, last run, last exit
  • secretbase health [<app>] --to <name> — the server's health, or one app's there: CPU and memory now and the 24-hour highs
  • secretbase domain <domain> [<app>] · secretbase domain list [<app>] — each with --to <name>: an app's own domain there, through that server's Cloudflare account
  • secretbase resources [<app>] [small|standard|large] [--cpus N] [--memory 1g] [--disk 8g] [--copies N | --copies LEAST-MOST] --to <name> — an app's CPU, memory, disk, copies there
  • secretbase domain approve --tunnel <tunnel> --to <name> — with a full-control Server token: move every name from a dead machine's tunnel to that server; it asks first
  • secretbase mcp --remote <name> — the AI-tool connection, publishing to that server