Skip to main content
Lookup tables for the CoinCover CLI. For the install-and-use walkthrough, see the CoinCover CLI guide.

​
Environments and API hosts

During first-time setup (or via Switch environment / API key) you choose one of four environments. The CLI stores one API key per environment. Environments that already have a saved API key are marked (key saved) in the list.

​
Protection modes and size limits

The key file must be non-empty. Envelope mode requires files larger than 470 bytes.

​
Passphrase rules (custom passphrases)

When you choose Create my own passphrase, it must be 16–128 characters, use at least three character classes, contain at least 10 distinct characters, and avoid common passwords or obvious patterns. The CLI validates each entry. By default the CLI generates a strong passphrase instead. Either way, you must save the passphrase outside the CLI — CoinCover cannot recover it.

​
Supported platforms and release assets

macOS (Intel or Apple Silicon), Linux (x86_64 or ARM64), or Windows x64. Replace v0.x.x with the release tag. Tarballs contain an executable named coincover at the archive root. Bare binaries (no extension) use the cc-cli-* filename — rename to coincover when adding to your PATH. Each release may include checksums.txt (and Cosign signature files on internal releases) for verification.

​
Local configuration file

Settings are stored at ~/.coincover/config.json. The file is created with mode 0600 (readable only by your user). It is not encrypted on disk — use full-disk encryption on the machine and restrict who can access your account. For stronger protection, future versions may move secrets into the OS keychain.

​
Backup receipts

After a successful backup upload, the CLI saves a JSON receipt at:
The timestamp uses ISO-8601 with colons replaced by hyphens for filesystem safety (e.g. 2026-05-27T11-45-12.123Z-a3f7c2d1-….json). Each receipt records backup_id, key_id, backup_name, package_id (your Backup ID), environment, and created_at — no passphrases or key material. Files are mode 0600; the receipts directory is 0700. The Backup complete screen includes the receipt path when saving succeeds.

​
Debug file logging

To record a detailed trace of CLI actions (menu choices, API calls, encryption steps, file paths), set:
Then run the CLI as usual. Logs are appended to:
Each line is ISO-timestamped. API keys, passphrases, private keys, and ciphertext payloads are not written in full — but logs may still contain file paths, user identifiers, and backup metadata. Treat log files as sensitive; enable only while diagnosing an issue, then disable (unset CC_LOGS) and delete old logs when finished.

​
Troubleshooting

​
Security checklist

  • Passphrases: store backup passphrases (CLI-generated or your own) in a team vault or password manager, separate from key files and from the encrypted backup blob.
  • API keys: treat like secrets; do not commit ~/.coincover/config.json to source control.
  • Environment: read the Environment: line in the CLI before backing up — confirm you are on prod (or your intended target), not dev or staging.
  • Machine: prefer a dedicated, patched workstation with disk encryption for backup and recovery operations.
  • Recovery files: handle released private keys and ciphertext with the same care as plaintext keys; delete local copies when your policy allows.