FAQ¶
Common questions about CodeFetch.
General¶
What is CodeFetch?
CodeFetch is a secure, encrypted library for storing and running scripts and operational files across any infrastructure. You publish files from VS Code, then fetch and execute them from any machine — Linux, macOS, or Windows — with a single command: codefetch get <ID>.
Is CodeFetch free?
CodeFetch offers a free tier alongside paid tiers for higher usage — see Quota & Limits for current defaults, and Settings → Billing in the web app for your account's actual pricing and limits, since these are configured server-side and can change.
What file types can I store?
Any file type. Common uses include shell scripts (.sh, .bash, .zsh), PowerShell (.ps1), Python, Ruby, configuration files (.yaml, .json, .toml, .env), and templates. CodeFetch is not limited to scripts.
Does CodeFetch replace my source repository?
No. Your source files stay in your own repos. CodeFetch is the delivery layer that gets operational assets where they need to run — think of it as a secure, executable clipboard for your infrastructure, not a replacement for Git.
How do I delete my account?
Go to Settings → Delete Account in the web app at app.codefetch.io. You'll receive an email confirmation code before the deletion is actually carried out. This permanently removes your account, all published files, and all shared links — the action cannot be undone. See Delete Your Account for the details of that confirmation step.
Security¶
How is my data secured?
All files are encrypted with AES-256-GCM using your secret key before they are stored. The CodeFetch servers hold only ciphertext — without your key the content is unreadable. Decryption happens on your machine, not on CodeFetch servers. All data is transmitted over TLS.
Can CodeFetch read my scripts?
No. Your files are encrypted with your secret key before storage. The backend stores only a one-way hash of your key for authentication — it cannot be reversed. The CodeFetch team cannot read your file contents. File metadata (filenames, descriptions, tags) is not encrypted.
What are shared links and are they safe?
Shared links give someone access to a single file without sharing your secret key or exposing the rest of your library. They are your responsibility once distributed — anyone with the URL can execute that file. Revoke them from the web app when no longer needed. For extra control, shortened links via a Shorty instance support an IPv4 allowlist so the link only works from specific machines.
What happens if I lose my secret key?
The backend stores only a one-way hash — your key cannot be recovered by support. If you lose it, your published files cannot be decrypted with a new key until you rotate. You can generate a new secret key from Settings → Change Secret in the web app — this re-encrypts your existing files with the new key automatically, so you don't lose access, but you do need the old key to do it. If you've genuinely lost the old key with no way to recover it, there is no way to re-encrypt those files — treat your secret key like a password and store it somewhere safe.
How is the CLI config protected on my machine?
The CLI configuration file (containing your account URL and secret key) is encrypted and bound to your machine's hardware ID, hostname, and username. This prevents other users on the same machine from accessing your config, and prevents the config file from being copied to a different machine and used there.
Web App¶
How do I find a script's ID in the web app?
Every file in your library has a unique ID shown in its entry. Click Copy ID to copy it to the clipboard, then use it with the CLI: codefetch get <ID>.
How do I rotate my secret key without losing access to my files?
Go to Settings → Change Secret in the web app. The rotation process re-encrypts all your published files with the new key automatically — you don't need to re-publish anything. After rotating, update the CLI with codefetch config and re-enter your credentials in the VS Code extension via CodeFetch: Configure Settings. See Changing Your Secret for the underlying API if you want to script it.
Where do I manage billing?
Go to Settings → Billing in the web app. This opens the Stripe customer portal where you can view invoices, update payment details, and manage your subscription.
Command-Line Interface¶
What platforms does the CLI support?
Linux, macOS, and Windows — both amd64 and arm64 architectures. See Getting Started for the install commands per platform.
How do I upgrade the CLI?
Run the same install command again. It replaces the existing binary with the latest release. No separate upgrade command is needed.
Can I use CodeFetch in CI/CD pipelines?
Yes. Pass credentials at runtime using flags instead of relying on a local config file:
Store CODEFETCH_URI and CODEFETCH_SECRET as secrets in your CI provider. The same flags work with codefetch playbook run. See CI/CD — No Config File Needed.
Can I run a script without executing it immediately?
Yes. Use --save to download the script to a local temp file instead of running it:
The path is copied to your clipboard so you can inspect or run it manually.
What are playbooks?
Playbooks let you chain multiple scripts and execute them in sequence with a single command. Tag scripts with a shared group tag and sequence numbers (deploy-prod, #1), then export and run:
codefetch playbook export deploy-prod ~/playbooks/deploy-prod.json
codefetch playbook run ~/playbooks/deploy-prod.json
See the CLI guide for full details, including building a playbook interactively from the TUI.
Clipboard support isn't working on Linux.
The --save flag copies the file path to the clipboard. On Linux this requires either xclip or xsel to be installed:
VS Code Extension¶
Where are my credentials stored by the extension?
In VS Code's built-in SecretStorage API. Nothing is written to settings.json, .env, or any workspace file — your credentials will never accidentally appear in source control.
I renamed a file — do I need to re-publish it?
No. The extension handles renames and moves automatically. The library record updates to match the new name and path with no manual action required.
How does the team workflow with .codefetch/ work?
Commit the .codefetch/ folder in your repository alongside your code. When a teammate clones the repo, the extension reads that folder and immediately shows ✓ badges on all published files — without anyone needing to re-publish. Each repository is independent, so multiple repos in the same workspace don't interfere with each other.
Can I turn off auto-sync?
Yes. Open VS Code settings (Ctrl+,) and set codefetch.autoUpdateOnChange to false. You can then push updates manually by right-clicking the file and selecting CodeFetch: Update File. See Extension Settings for this and other settings.
I have a question that isn't answered here.
Email us at support@codefetch.io and we'll get back to you.