> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blindcast.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# CLI Overview

> One command-line tool for everything server-side: generate keys, encrypt HLS segments, upload to S3, and run a local dev key server.

The BlindCast CLI handles the server-side workflow: generate keys, encrypt video, upload to storage, and run a local key server for development. One tool, five subcommands.

## Install

```bash theme={null}
npm install -g @blindcast/cli
```

Or use without installing:

```bash theme={null}
npx @blindcast/cli <command>
```

## Subcommands

| Command                             | What it does                                                |
| ----------------------------------- | ----------------------------------------------------------- |
| [`blindcast init`](/cli/init)       | Create a sample project with HLS segments and a player page |
| [`blindcast keygen`](/cli/keygen)   | Generate a master key and salt                              |
| [`blindcast encrypt`](/cli/encrypt) | Encrypt HLS segments and rewrite the manifest               |
| [`blindcast upload`](/cli/upload)   | Upload encrypted segments to S3                             |
| [`blindcast serve`](/cli/serve)     | Start a local development key server                        |

## Environment variables

All subcommands accept keys via flags or environment variables. Set these in a `.env` file or export them in your shell:

| Variable                | Used by        | Description                              |
| ----------------------- | -------------- | ---------------------------------------- |
| `BLINDCAST_MASTER_KEY`  | encrypt, serve | Master key as hex string (from `keygen`) |
| `BLINDCAST_SALT`        | encrypt, serve | Salt as hex string (from `keygen`)       |
| `AWS_ACCESS_KEY_ID`     | upload         | AWS credentials (standard SDK chain)     |
| `AWS_SECRET_ACCESS_KEY` | upload         | AWS credentials (standard SDK chain)     |
| `AWS_REGION`            | upload         | AWS region (default: `us-east-1`)        |

## Error handling

The CLI uses Unix exit codes:

| Exit code | Meaning                                                         |
| --------- | --------------------------------------------------------------- |
| `0`       | Success                                                         |
| `1`       | User error (invalid flags, missing input, bad config)           |
| `2`       | Runtime error (encryption failed, upload failed, network error) |

Errors are printed to stderr in human-readable format. Add `--json` to any subcommand for machine-readable JSON errors on stderr.

## Quick start

See the [Quick Start](/getting-started/quick-start) for a complete walkthrough: init, keygen, encrypt, serve, and play — all in \~10 minutes.