Command line · bw

Bitwarden CLI

Q: How do I keep the session alive?

Once unlocked, store BW_SESSION in your shell environment. The session expires per the vault timeout setting (default: 15 min idle). For long-running CI jobs, unlock once at start, hold the session token in env, run your sequence, log out at end.

Q: Does the CLI support Bitwarden organizations?

Yes — bw list items --organizationid <UUID> filters to a specific org's shared items. bw list collections lists collections within orgs.

Q: Can I use the CLI against a self-hosted server?

Yes — bw config server https://vault.your-domain.com before login, and the CLI talks to your instance instead of bitwarden.com. Useful for self-hosted setups.

The Bitwarden CLI (bw) is a separate native binary that talks to the same vault as the desktop app. Useful for shell scripts, CI pipelines, GitHub Actions, server automation, and anything where you need vault data without a GUI.

Installation paths

npm (cross-platform)

npm install -g @bitwarden/cli
bw --version

Native binary (Windows, Mac, Linux)

# Linux x64
wget https://github.com/bitwarden/clients/releases/latest/download/bw-linux-X.X.X.zip
unzip bw-linux-X.X.X.zip
sudo mv bw /usr/local/bin/
bw --version

# macOS
wget https://github.com/bitwarden/clients/releases/latest/download/bw-macos-X.X.X.zip
unzip bw-macos-X.X.X.zip
sudo mv bw /usr/local/bin/

# Windows: download bw-windows-X.X.X.zip, extract, add to PATH

Homebrew (Mac, Linux)

brew install bitwarden-cli

Scoop (Windows)

scoop install bitwarden-cli

Chocolatey (Windows)

choco install bitwarden-cli

Linux binary Mac binary Windows binary

# Interactive login
bw login [email protected]

# Or with API key (recommended for CI)
export BW_CLIENTID=user.xxxxxxxx
export BW_CLIENTSECRET=yyyyyyyyyy
bw login --apikey

# Unlock vault and store session token
export BW_SESSION=$(bw unlock --raw)

Common commands

# List all items
bw list items

# Get a specific item
bw get item "GitHub deploy key"

# Get just the password
bw get password "GitHub deploy key"

# Get TOTP code
bw get totp "GitHub deploy key"

# Search by URL
bw list items --url github.com

# Export vault to JSON
bw export --format json --output vault.json

# Sync to fetch latest
bw sync

CI / GitHub Actions integration

Bitwarden CLI is the standard way to inject secrets into pipelines without baking them into the repo:

# GitHub Actions example
- name: Setup Bitwarden CLI
  run: npm install -g @bitwarden/cli

- name: Authenticate Bitwarden
  env:
    BW_CLIENTID: ${{ secrets.BW_CLIENTID }}
    BW_CLIENTSECRET: ${{ secrets.BW_CLIENTSECRET }}
    BW_PASSWORD: ${{ secrets.BW_PASSWORD }}
  run: |
    bw login --apikey
    BW_SESSION=$(bw unlock --passwordenv BW_PASSWORD --raw)
    echo "BW_SESSION=$BW_SESSION" >> $GITHUB_ENV

- name: Use a secret
  run: |
    DEPLOY_KEY=$(bw get password "Production deploy key")
    # ... use DEPLOY_KEY in deployment

Bitwarden also publishes a maintained official GitHub Action for Bitwarden Secrets Manager (the SaaS-style secrets product) — different from this CLI but worth knowing about.

CLI vs Secrets Manager

Confusingly, Bitwarden has two adjacent products:

Bitwarden CLI (bw): reads/writes individual vault items. Personal vault, shared organisations, all the items you use in the desktop app.
Bitwarden Secrets Manager: separate product, separate billing, dedicated to machine-to-machine secret distribution. Different CLI (bws), different API, different SDKs in many languages.

For personal scripts and small-team workflows, bw is enough. For production-scale secret distribution to many services, Secrets Manager is the right tier.

Bitwarden CLI — frequently asked questions

Is npm or native binary preferred?

Native binary is faster cold-start (~50ms vs ~500ms for the npm wrapped Node version). For one-off scripts on dev machines, npm is fine. For CI runners that invoke bw hundreds of times, prefer native binary.

How do I keep the session alive?

Once unlocked, store BW_SESSION in your shell environment. The session expires per the vault timeout setting (default: 15 min idle). For long-running CI jobs, unlock once at start, hold the session token in env, run your sequence, log out at end.

Can I run bw without internet?

No — every command syncs against the server (or your self-hosted instance). For air-gapped use, export to JSON beforehand and parse from a local file: bw export --format json --output vault.json, then jq against vault.json.

Does the CLI support Bitwarden organizations?

Yes — bw list items --organizationid <UUID> filters to a specific org's shared items. bw list collections lists collections within orgs.

Can I use the CLI against a self-hosted server?

Yes — bw config server https://vault.your-domain.com before login, and the CLI talks to your instance instead of bitwarden.com. Useful for self-hosted setups.

Is there a Python or Go SDK?

Bitwarden Secrets Manager (the separate product) has SDKs in Python, Go, JavaScript, C#, Ruby. The bw CLI itself is Node-based and exposes only command-line interface; there's no first-party SDK for the personal vault. Community wrappers exist on GitHub.