abadge mount resolves a secret and writes it to a temporary file. The CLI prints the file path so you can use it in subsequent commands.
The file is written with 0600 permissions. By default it lands at <os.tmpdir()>/abadge-<uuid>; pass --path to choose the location. The CLI does not track or auto-clean the file — remove it yourself when you’re done.
Usage
Flags
Behavior
1
Resolve the secret
Same access path as
abadge run: POST /v1/access/{itemId}/use with delivery: file, with daemon decryption for zero-knowledge items.2
Write the file
The CLI writes the resolved secret value to
--path (or a generated temp path), creating parent directories as needed, with 0600 permissions.3
Print the path
The CLI prints
Mounted at: <path> on stdout.Cleanup
abadge mount does not track the file or expire it. The file persists until you delete it manually.
Use cases
- Loading a TLS private key into nginx
- Passing an SSH key to
ssh -i - Feeding a service-account JSON to a Google Cloud client
- Anything that takes a
--key-filestyle argument and not an env var
Errors
Related
abadge run— env-var injection instead of file mount- Field delivery
- API reference