CLI

🍰 Honeycake CLI - Headless document encryption tool Usage: honeycake [options] <command> [arguments] Global Options: -h, --help Show usage help -v, --version Show version information -g, --groups List organization groups --output=json Output structured JSON (for MCP/automation) --env=<env> Set environment: local|dev|staging|production (default: production) Commands: auth login <email> - Authenticate with Honeycake auth login-browser - Authenticate via browser (PKCE) auth verify <email> <code> - Verify email auth pin <email> <pin> - Enter or set PIN auth status - Check authentication status auth logout - Log out current user bake <file> - Encrypt and register a file --title <title> - Set file title (default: filename) --ttl <duration> - Set time-to-live (e.g., 30d, 1w, 24h) --grant <emails> - Grant access to comma-separated emails --grant-group <ids> - Grant access to group IDs (use --groups to list) --deny <emails> - Deny access to comma-separated emails --deny-group <ids> - Deny access to group IDs --no-layered - Disable layered encryption (ignores .hcrc) --encrypt-pages <json> - Page-level encryption as JSON object or file path --redaction-sections <json> - Redaction areas as JSON array or file path --redaction-format <fmt> - parBaked (default) or fullyBaked bakedir <dir> - Encrypt all files in a directory -r, --recursive - Include subdirectories (same flags as bake: --title, --ttl, --grant, etc.) unbake <file.cake> - Decrypt a .cake file list - List your documents Authentication: honeycake auth login-browser # Login via browser (recommended) honeycake auth login user@example.com # Login via email code honeycake auth status # Check who is logged in honeycake auth logout # Log out Basic Encryption: honeycake bake document.pdf # Encrypt (only you can decrypt) honeycake bake document.pdf --grant sarah.hr@co.com # Share with specific user honeycake bake document.pdf --grant sarah.hr@co.com,gc@co.com --ttl 7d honeycake bake document.pdf --grant-group 5 # Share with a group honeycake bake document.pdf --grant-group 5 --deny alex.park@co.com honeycake bake document.pdf --title "Q4 Report" # Custom title Batch Encryption: honeycake bakedir ./contracts/ # Encrypt all files in directory honeycake bakedir ./contracts/ -r --grant gc@co.com # Recursive with sharing Decryption: honeycake unbake document.pdf.cake # Standard encrypted file honeycake unbake report.cake.pdf # Par-baked PDF (redacted) honeycake unbake report.pdf.cake # Fully-baked PDF PDF Redaction (par-bake): # Redact a region on page 1 (only you can see the original): honeycake bake report.pdf \ --redaction-sections '[{"page":0,"x":72,"y":200,"width":200,"height":24}]' # Redact and share the original with specific people: honeycake bake report.pdf --grant sarah.hr@co.com \ --redaction-sections '[{"page":0,"x":72,"y":200,"width":200,"height":24}]' # Redact multiple areas across pages: honeycake bake report.pdf --grant sarah.hr@co.com,gc@co.com \ --redaction-sections '[ {"page":0,"x":72,"y":200,"width":200,"height":24}, {"page":0,"x":72,"y":400,"width":300,"height":24}, {"page":2,"x":100,"y":150,"width":250,"height":50} ]' # Load redaction sections from a file: honeycake bake report.pdf --redaction-sections sections.json # Fully-baked: only Honeycake users can open the file at all: honeycake bake report.pdf --redaction-sections sections.json \ --redaction-format fullyBaked --grant sarah.hr@co.com Coordinates are in PDF points (1 point = 1/72 inch, US Letter = 612x792). Par-baked (.cake.pdf): anyone sees redacted version, authorized users recover original. Fully-baked (.pdf.cake): only authorized Honeycake users can open the file. Page-Level Encryption (PDF): # Encrypt specific pages with per-page permissions: honeycake bake report.pdf --encrypt-pages '{"1":"sarah.hr@co.com","3":"gc@co.com"}' # Full grant/deny per page: honeycake bake report.pdf --encrypt-pages '{"1":{"grant":["sarah.hr@co.com"],"deny":["alex.park@co.com"]}}' # Load from a file: honeycake bake report.pdf --encrypt-pages pages.json Pages are 1-indexed. Each page gets its own encryption key and permissions. Uses the same permission format as .hcrc layered_fields. Layered Encryption (.hcrc): Place .hcrc in the file's directory for automatic field-level encryption. Per-file override: .{filename}.hcrc (e.g. .payroll.csv.hcrc) honeycake bake payroll.csv # Uses .hcrc auto-discovery honeycake bake payroll.csv --no-layered # Skip .hcrc, whole-file only See docs/cli/hcrc-configuration.md for full reference. JSON Output (for scripting/MCP): honeycake --output=json auth status honeycake --output=json bake document.pdf --grant sarah.hr@co.com Organization: honeycake --groups # List available groups honeycake list # List your documents Development/Testing: honeycake --env=local auth login testuser@example.com honeycake --env=dev auth login testuser@example.com honeycake --env=staging bake test.pdf For more information, visit: https://honeycakefiles.com