Without Server (Git-backed)
Alice
(member)
push
GitHub
.kagi/ committed
pull
Bob
(member)
.kagi/
├─ kagi.json
├─ access.json
└─ secrets/
.kagi/
├─ kagi.json
├─ access.json
└─ secrets/
.kagi/
├─ kagi.json
├─ access.json
└─ secrets/
Encrypted secrets are shared through Git commits and pulls. New members use `kagi member request` to request access, and existing members use `kagi member approve` to grant it.
With Server — Init Flow
1
Admin starts the server
kagi serve --db ./kagi.db --key-file ./server.key.json --bind 127.0.0.1:8787
Kagi Server
└─ kagi.db (projects / members)
2
First boot generates admin token, admin logs in
kagi remote login --remote http://127.0.0.1:8787 --token kagi_admin_v1_...
With Server — Team Flow
Alice
(member)
kagi remote push / remote pull
Kagi Server
kagi.db
kagi init kagi remote register --remote ...
kagi remote pull <token> kagi remote push
1
Alice initializes local project and requests to join the server
2
Admin reviews and approves:
kagi remote projects --remote ... kagi remote approve <project_id>
After approval, prints project token and gives it to Alice
3
Alice pulls the project with the token, then uses `kagi remote push / remote pull` to sync encrypted secrets
.kagi/ stays local and out of Git. Project tokens contain the remote URL, project ID, and server fingerprint.