Without Server (Git-backed)

Alice

(member)

push

GitHub

.kagi/ committed

pull

Bob

(member)

.kagi/
├─ kagi.json
├─ access.json
└─ secrets/

Encrypted secrets are shared through Git commits and pulls. New members use kagi member request to request access, and existing members use kagi member approve to grant it.

With Server — Init Flow

1

Admin starts the server

kagi serve --db ./kagi.db --key-file ./server.key.json --bind 127.0.0.1:8787

└─ kagi.db (projects / members)

2

First boot generates admin token, admin logs in

kagi remote login --remote http://127.0.0.1:8787 --token kagi_admin_v1_...

With Server — Team Flow

Alice

(member)

kagi remote push / remote pull

Kagi Server

kagi.db

kagi init
kagi remote register --remote ...
      

kagi remote pull <token>
kagi remote push
      

1

Alice initializes local project and requests to join the server

2

Admin reviews and approves:

kagi remote projects --remote ...
kagi remote approve <project_id>

After approval, prints project token and gives it to Alice

3

Alice pulls the project with the token, then uses kagi remote push / remote pull to sync encrypted secrets

.kagi/ stays local and out of Git. Project tokens contain the remote URL, project ID, and server fingerprint.