Releases

Python connector 0.1.5: Automated secrets management

Eirik Salmi Nov 14, 2025

The new Python connector version 0.1.5 expands CLI utility capabilities. We've added commands that solve critical tasks for DevOps engineers and developers — secure retrieval and updating of secrets in automated pipelines.

What this solves

Hardcoded secrets, API keys, tokens, and database credentials create security vulnerabilities and operational bottlenecks. Manual secret management introduces delays and human error into deployment pipelines. The new get and update commands in passwork-cli fully automate secrets management. Passwork functions as your single source of truth (SSOT): secrets stay centralized, secure, and fully automated.

How the new commands work

get — retrieves data from Passwork
update — updates data in Passwork

Both commands support all field types: passwords, tokens, API keys, and custom fields.

Get: Retrieving data from entries

The get command extracts any field value from an entry and fits perfectly into automation scripts.

Retrieving specific fields

Use the --field flag to extract login, URL, or values from any custom field.

# Get API access token from custom field 'API_TOKEN'
export API_TOKEN=$(passwork-cli get --password-id "..." --field API_TOKEN)

Generating TOTP codes

If you store two-factor authentication secrets in Passwork, passwork-cli generates the current code directly in your terminal. Use the --totp-code flag.

# Get TOTP code for VPN connection
VPN_TOTP=$(passwork-cli get --password-id "..." --totp-code "VPN_SECRET")

Update: Modifying secrets

The update command changes data in Passwork and automates secret rotation.

Updating custom fields

The --custom-<field_name> flag updates values in custom fields.

# Update API key in entry
passwork-cli update --password-id "..." --custom-API_KEY "new-generated-key"

Bulk updates

Now you can modify multiple fields with a single command.

# Update password and tags simultaneously
passwork-cli update \
  --password-id "..." \
  --password "NewComplexP@ssw0rd" \
  --tags "production,rotated,automated"

Client-side encryption support

Both get and update commands fully support Passwork's client-side encryption mode. When using get, all encrypted fields are automatically decrypted using the master key. When executing update, data is first encrypted on your side and only then sent to the server.