What the CLI does
The CLI can enroll a service, encrypt files locally before upload, create shares, download encrypted parts, and decrypt locally after download using service configuration kept outside browser code.
Automation
CLI and service API automation
ZipPigeon automation is designed for backends and operators that need encrypted upload, sharing, and download workflows without putting secrets in browser code.
Signed service requests
Migrated v3 service API calls use Ed25519 + ML-DSA-65 dual signatures over method, path, timestamp, nonce, body hash, and service account ID. Legacy service identities continue using their versioned authentication format until migration. Replay protection and timestamp tolerance are part of the request model.
Post-quantum service envelopes
V3 service identities use X-Wing draft-10 HPKE, combining X25519 with ML-KEM-768, to protect payload keys for eligible service-owned uploads and shares. The CLI migration ceremony proves decapsulation before replacing the encrypted local service bundle.
Token and scope boundaries
Service tokens are scoped for upload, share, and download actions. Token secrets are shown once, should live in a backend secret manager or local shell environment, and can be revoked.
Verified standalone distribution
Downloadable CLI bundles are available directly for Linux and macOS on x64 and ARM64, plus the unsigned Windows x64 preview. Each bundle contains the versioned standalone archive and its SHA-256 checksum. Customers do not install Node.js or npm.
Frequently asked questions
Can the CLI encrypt before upload?
Yes. The local CLI workflow encrypts before upload and decrypts after download, keeping service key bundles and passphrases outside browser code.
Should service tokens be used in frontend JavaScript?
No. Service tokens, key bundles, and passphrases belong in backend secret managers or local operator environments, not public browser code.
Send the file. Keep control of the link.
Use ZipPigeon when a file needs to reach the right person without becoming another attachment or shared folder to clean up later.
Open signed-in sender