Lazelaze
Sign inSign up

Vault from Claude Code and Codex

Sign in with your own account and let Claude Code, Codex, a terminal or a script use your vault keys, with a reason and your approval.

Claude Code, Codex, a terminal or a script on your own machine can use the keys in your Laze vault without becoming a Laze agent. You sign in once with your own account, and each command asks for a key with a reason. The value goes into the command's environment, never into the session's context.

Sign in

The CLI needs Node.js 22 or later.

npm i -g @lazehq/cli@latest
laze login

laze login prints a code and opens Laze in your browser; check that the browser shows the same code and approve it. On a server without a browser, make a key under Settings, CLI and API keys and run laze login --token lz_.... laze whoami shows who the CLI speaks for.

The sign-in is kept in ~/.laze/config.json. To keep several accounts apart, pass --profile <name> or set LAZE_CLI_CONFIG to another file. If the folder is linked to a connected agent, that agent's profile wins: pass --profile with your own profile to ask as yourself.

Run a command with a key

laze vault run gmail --reason "Read the password reset emails for the support reply" -- python read_inbox.py

The reason is one plain sentence. It is the first thing the person approving reads, so say what the command does and why. The command's output is redacted, so a value printed by mistake shows as hidden. laze vault env does the same for several keys at once, from a .env-style list of references.

Who asks

Each command asks as the session it runs in:

Where the command runsHow the card names it
Claude CodeClaude Code session, with the machine and folder
CodexCodex session, with the machine and folder
A terminalTerminal, with the machine
A script with no terminalScript, with its folder

Add --as fix-login or set LAZE_SESSION_NAME to give the session a name, so the card reads "Claude Code session 'fix-login' on my-laptop in api". The session belongs to you and uses your keys, under each key's level.

Approve the request

When a key needs approval, a card arrives in your Feed, as a push on your phone and in the Laze app's Approvals. The card shows the reason first; the full command is under Command. Answer with:

  • Allow: release the value for this command only.
  • Allow for this session: a lease for the session that asked, up to the key's maximum, at most two days. A new Claude Code or Codex session asks again.
  • Deny: refuse, with an optional note that the command prints.

Nothing asks less from outside Laze. An Always ask key asks for every use, a Human only key is refused, and sending email or messages outside the company asks every time.

Waiting for an answer

A card waits 24 hours, and laze vault run waits as long. --wait <seconds> stops waiting earlier with exit code 75; run the same command again to keep waiting on the same card. A denied use exits with code 77, and a reason that is not one plain sentence exits with code 2.

Claude Code's Bash tool stops a command after at most ten minutes. When an approval may take longer, start the command in the background and read its output once it finishes.

Also check: Vault and access, CLI reference.