Skip to main content
Flume uses an encrypted vault to store sensitive values like passwords and API keys. Secrets are encrypted with AES-256-GCM, keyed from your passphrase via Argon2.

​
Setup

You’ll be prompted to create a passphrase. This encrypts the vault file at ~/.local/share/flume/vault.toml.

​
Storing Secrets

​
Listing Secrets

Shows secret names (not values).

​
Deleting Secrets

​
Referencing Secrets in Config

Use ${secret_name} syntax in irc.toml:
The value is resolved from the vault at runtime.

​
Unlocking on Startup

If a vault exists, Flume prompts for the passphrase on startup. Press Enter to skip (secrets won’t be available until unlocked). You can also set the FLUME_VAULT_PASS environment variable to auto-unlock.

​
Changing the Passphrase