Command-line interface

Install or run once#

npx privatenote-cli --help

# Optional global install
npm install -g privatenote-cli

A global install adds the privatenote command. The examples below use npx so a global installation is optional.

Create a note from a file#

Create demo.txt with dummy content, then run:

npx privatenote-cli --expire 1h --output-url-only < demo.txt

npx privatenote-cli --expire 1h --output-url-only demo.txt

The output is the full link. Keep it out of shared terminal recordings and build logs. On macOS, pipe the URL directly to the clipboard:

npx privatenote-cli --expire 1h --output-url-only < demo.txt | pbcopy

Sign in and add a password#

npx privatenote-cli login
npx privatenote-cli whoami

# The first line of passphrase.txt supplies the reveal password
npx privatenote-cli --password-file passphrase.txt --expire 1h --output-url-only demo.txt

npx privatenote-cli logout

Approve sign-in in the browser opened by the CLI. The CLI session is separate from the website and MCP session. Keep the passphrase file private and send its password separately from the generated link.

Flags#

--expire <duration>#

Default 24h. Presets from 5m through 30d; longer than 3 days requires a paid account.

--burn / --no-burn#

Burn after first reveal by default. --no-burn requests two reads and needs a paid account.

--title <text>#

Prepend a title before encryption.

--password-file <path>#

Use the first line as a reveal passphrase.

--output-url-only#

Print only the link, including when stdout is piped.

--json#

Print structured creation output. Cannot be combined with --output-url-only.

--force-stdout#

Explicitly permit captured stdout; needed for --json in scripts.

--api-base-url / --web-origin#

Override API and recipient web origins for your deployment.

--insecure#

Permit HTTP for local development. Use HTTPS for remote deployments.

--allow-origin-mismatch#

Override the normal matching-origin guard. Avoid unless you deliberately operate separate API and web origins.

Captured output and CI#

The CLI refuses to print a sharing link to non-terminal stdout unless you explicitly pass --output-url-only or --force-stdout. This guard helps prevent accidental disclosure in captured output.

npx privatenote-cli --expire 1h --json --force-stdout < demo.txt

Self-hosted configuration#

PRIVATENOTE_API_BASE_URL#

Default API base URL. Remote requests require HTTPS.

PRIVATENOTE_WEB_ORIGIN#

Share-link origin; defaults to the API origin.

PRIVATENOTE_ALLOWED_HOSTS#

Comma-separated hostname allowlist for endpoint pinning.

For a local development API, pass --insecure --api-base-url http://127.0.0.1:8787. A recipient also needs the matching web application to reveal the link.