> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/secrets-manager/secrets-manager-command-line-interface/exec-command.md).

# Exec Command

Execute arbitrary system calls and replaces templated environment variables with Keeper vault secrets

## `exec` command

Use the **`ksm exec`** command to substitute environment variables with vault secrets.

**Parameters:**

System call or script to run with replaced environment variables

format: **`ksm exec -- <SYSTEM CALL OR SCRIPT>`**

{% hint style="info" %}
**Windows:** The CLI passes everything after `--` (the wrapped command and its arguments) to the child process exactly as typed. The CLI does not expand `%VAR%` or `$VAR` references, and does not collapse `$$` to `$`, in these arguments.
{% endhint %}

#### Example Linux bash script

{% code title="my\_script.sh" %}

```bash
#!/bin/bash

# Bash script that pulls Keeper secrets 

connect_db() {
  echo "Database Password:" $DB_PASSWORD
}

call_stripe() {
  echo "API Key:" $API_KEY
}

connect_db
call_stripe
```

{% endcode %}

Set two environment variables, then run the script:

```bash
$ export DB_PASSWORD="keeper://XXX/field/password"
$ export API_KEY="keeper://XXX/custom_field/API Key"

$ ksm exec -- ./my_script.sh

Database Password: ksv33110sbnb7W@b3VGCHb
API Key: sk_test_MY2A30Ofg6Ukkq2NjMQVo87c
```

#### Example Windows batch file

```
C:\> ksm exec -- my_script.bat
```

#### Example PowerShell script

```
PS C:\> ksm exec -- powershell my_script.ps1
```

## Environment Variable Replacement

Environment variables must be templated so that the CLI can find and replace them correctly. See the Keeper Notation documentation for notation query format and capabilities. For example:

```bash
export DB_PASSWORD="keeper://XXX/field/password"
export API_KEY="keeper://XXX/custom_field/API Key"
```

{% hint style="warning" %}
The secret values `ksm exec` substitutes into environment variables are inherited by the child process's environment. Anything able to inspect that process (for example, reading `/proc/<pid>/environ` on Linux as the same user or root, or using Process Explorer on Windows) can read them. Use `ksm exec` only where other local processes and users on the machine are trusted.
{% endhint %}

## Example Shell Script

Below is a Linux bash script example. Before an application is started or a command is run, any environment variables that start with **`keeper://`** will be replaced with secret values from the vault. Make sure to replace XXXX with the Record UID of the secret.

```
export MY_PASSWORD=keeper://XXXX/field/password
export MY_OTHER_PASSWORD=keeper://XXXX/field/password[0]
export MY_LAST_NAME=keeper://XXXX/custom_field/Name 2[last]
export MY_SECOND_PHONE=keeper://XXXX/custom_field/phone[1][number]
```

Here's a simple bash script that prints the secrets to the console:

```
#!/usr/bin/env bash
echo
echo "My Password = \${MY_PASSWORD}"
echo "Other Password = \${MY_OTHER_PASSWORD}"
echo "My Last Name = \${MY_LAST_NAME}"
echo "My Second Phone = \${MY_SECOND_PHONE}"
```

And here's the output from executing the bash script with **`ksm exec`**

```
$ ksm exec -- ./my_script.sh

My Password = $71387feh24fE%4416ffFHA
Other Password = YYFash328f^F^@#Fsdfjhsgblqef'f;
My Last Name = Smith
My Second Phone = 123-456-7890
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.keeper.io/keeperpam/secrets-manager/secrets-manager-command-line-interface/exec-command.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.