Retrieving data (get)

Retrieving data from items and shortcuts

This example demonstrates how to retrieve items and shortcuts from Passwork using the get mode, as well as how to extract specific fields from them.

Use cases

The get command provides many use cases for securely working with data from Passwork:

1. Extracting specific fields — retrieving individual values (name, password, login, URL, description, tags, or custom fields)
2. Using in scripts — integration into bash scripts and other automation tools for secure password handling
3. CI/CD pipelines — passing secrets to build and deployment processes without storing them in configuration files
4. TOTP code generation — creating one-time passwords for two-factor authentication from secrets stored in custom fields
5. Retrieving custom data — extracting API keys, access tokens, and other custom fields from records
6. Working with shortcuts — retrieving data through shortcuts to access items from other vaults
7. Secure password management — retrieving passwords without saving to disk or command line history

Item/shortcut identification

Specify the data source, one of the parameters is required:

Parameter	Description
--password-id	Item ID
--shortcut-id	Shortcut ID

Output modes and extraction

Option	Value/example	Description
--field	name, login, password, url, description, tags, <custom_field_name>	Outputs only the specified field. Custom fields are specified by their name.
--json	—	Outputs all available data of the item/shortcut in JSON format.
--totp-code	<field_name_with_secret>	Generates and outputs a TOTP code from a field containing a secret in base32 or otpauth://.

Basic usage

Get password from item by ID

shell

passwork-cli get \
  --host "https://passwork.example.com" \
  --token "your_access_token" \
  --master-key "your_master_key" \
  --password-id "68793e13dfc88d879e0f2e39" \

By default, the password will be retrieved. If the password field is empty, an error will be displayed.

Using environment variables

You can export Passwork data as environment variables:

shell

export PASSWORK_HOST="https://passwork.example.com"
export PASSWORK_TOKEN="your_access_token"
export PASSWORK_MASTER_KEY="your_master_key"

# Then retrieve without specifying credentials
passwork-cli get --password-id "68793e13dfc88d879e0f2e39"

This is useful for automation scripts and CI/CD pipelines, where credentials can be securely stored as environment variables.

Extracting specific fields

shell

# Item name
passwork-cli get --password-id "68793e13dfc88d879e0f2e39" --field name

# Custom field (e.g., API_KEY)
passwork-cli get --password-id "68793e13dfc88d879e0f2e39" --field API_KEY

TOTP code generation

You can generate TOTP (Time-based One-Time Password) codes from secrets stored in custom fields. This is useful for two-factor authentication.

Using TOTP secret field

shell

# Generate TOTP code from a custom field containing a secret
passwork-cli get \
  --password-id "68793e13dfc88d879e0f2e39" \
  --totp-code "TOTP_SECRET" \

The --totp-code parameter expects the name of a field (custom) that contains:

• Raw TOTP secret (string in base32 encoding)
• Or otpauth:// URL (e.g., otpauth://totp/Service:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=Service)

The TOTP code will be output to stdout, making it easy to use in scripts or for copying.

Working with shortcuts

Examples for shortcuts:

shell

# Password from shortcut
passwork-cli get --shortcut-id "68d6c94bec3a3fe41209546e"

# Name field from shortcut
passwork-cli get --shortcut-id "68d6c94bec3a3fe41209546e" --field name

# TOTP from totp_secret field
passwork-cli get --shortcut-id "68d6c94bec3a3fe41209546e" --totp-code "totp_secret"

How it works

1. CLI connects to Passwork using the provided data
2. It retrieves an item or shortcut by ID
3. The item is decrypted using the master key (when using client-side encryption)
4. If --totp-code is specified, a TOTP code is generated from the specified field and output
5. If --field is specified, only the value of that field is output
6. If neither --totp-code nor --field is specified, the password value is output (or an error if it's empty)

Using in scripts

The get command is suitable for automation scripts where you need to retrieve specific values from an item:

shell

#!/bin/bash
DB_PASSWORD=$(passwork-cli get \
  --password-id "68d6c94bec3a3fe41209546e")

echo "Connecting to database..."
mysql -u admin -p"$DB_PASSWORD" mydatabase