Skip to content
1Claw Academy
Curriculum/Foundations2 minBeginner · Lesson 12 of 13

From local to cloud

Push your local vault to a hosted one when you need a second person, a second machine, or an agent.

The local vault has exactly three limits, and you hit them in a predictable order: you get a second machine, then a teammate, then an agent. All three need a vault that exists somewhere other than your laptop.

  • A second machine needs the secret to exist off your disk.
  • A teammate needs sharing, access control and an audit trail.
  • An agent needs a scoped identity, which is the whole rest of this course.
Watch out

Requires: a 1Claw account and a cloud vault. npx @1claw/cli setup creates one along with everything else in a single command.

  1. 1

    Log in. The browser flow means no password is typed into your terminal.

    bash
    1claw login
  2. 2

    Preview the move. Push is the default direction: local to cloud.

    bash
    1claw local sync --vault $VAULT_ID
  3. 3

    Pull instead, to seed a fresh laptop from a vault that already exists.

    bash
    1claw local sync --vault $VAULT_ID --pull
  4. 4

    Conflicts are skipped by default. Overwrite only when you are sure which side is authoritative.

    bash
    1claw local sync --vault $VAULT_ID --force
  5. 5

    Confirm the cloud side has what you expect.

    bash
    1claw secret list --vault $VAULT_ID
Tip

Sync skips conflicts rather than guessing. That is the right default and it means a sync can silently do less than you assumed, so read the summary rather than trusting the exit code.

Keeping the local vault after syncing is a reasonable choice. It works offline, it survives an outage, and it costs nothing. What changes is that the cloud vault becomes the authoritative copy once more than one person or machine depends on it.

From here the course is about the things only a hosted vault can do: policies that scope access per principal, agents as first-class identities with short-lived tokens, execution without ever handing over a credential, and an audit trail that answers who read what. The local vault got you started without a signup; the rest of this course is why teams outgrow it.

Check your understanding

3 questions
1

Which direction does `1claw local sync` move secrets by default?

2

What happens by default when a secret exists on both sides with different values?

3

What is the first thing the local vault cannot give you?