> For the complete documentation index, see [llms.txt](https://newdocs.keeper.io/en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://newdocs.keeper.io/en/keeperpam/secrets-manager/integrations/jetbrains-plugin.md).

# JetBrains Plugin

## About

JetBrains IDEs are powerful integrated development environments used by millions of developers worldwide for building applications across various programming languages and frameworks. Whether you're developing in Java, Python, JavaScript, or any other supported language, JetBrains IDEs provide comprehensive tools for coding, debugging, and deployment.

The Keeper Security plugin integrates Keeper Vault into JetBrains IDEs so developers can replace hardcoded secrets with vault references and run commands with injected credentials without exposing sensitive data. The plugin supports **Classic** and **Nested Shared Folder** vault items in the same actions — folder and record pickers, secret retrieval, record create/update/generate, and secure execution from `.env` files.

## Features

* **Secret Management**: Save, retrieve, and generate secrets directly from JetBrains IDEs using the Keeper Vault
* **Secure Execution**: Run commands with secrets injected from the Keeper Vault through `.env` file processing
* **HTTP Client Integration** (IntelliJ IDEA Ultimate / WebStorm / GoLand): Reference vault secrets directly in `.http` request files using the `{{$keeper("uid","field")}}` dynamic variable — no plaintext values in request files
* **Run Configurations**: Save a **Run Keeper Securely** configuration (`.env` path, working directory, command) under **Run → Edit Configurations** with output streaming to the Run tool window
* **Folder Management**: Select and manage Keeper vault folders for organized secret storage
* **Record Operations**: Create new records, update existing ones, and retrieve field references
* **Cross-platform support**: Windows, macOS, Linux
* **Nested Shared Folders**: Classic and Nested Shared folders and records in the same actions; automatic routing to `record-*` or `nsf-*` Commander commands
* **Searchable pickers**: Folder and record lists include **Classic** / **Nested** badges on each row
* **Community Edition support**: Core vault actions work on IntelliJ IDEA Community Edition; HTTP Client integration requires Ultimate / WebStorm / GoLand

## Prerequisites

* **Keeper Commander CLI**
  * Must be installed and authenticated on your system
  * Download from [Keeper Commander Installation Guide](/en/keeperpam/commander-cli/commander-installation-setup.md)
  * Authenticate using [Persistent login](/en/keeperpam/commander-cli/commander-installation-setup/logging-in.md#persistent-login-sessions-stay-logged-in) or [Biometric login](/en/keeperpam/commander-cli/commander-installation-setup/logging-in.md#logging-in-with-biometric-authentication)
  * **Keeper Security Account**: Active subscription with vault access
* **Nested Shared Folder operations** require a recent Keeper Commander with `nsf-*` commands. If you see errors such as unknown `nsf-record-add`, upgrade Commander:

  ```bash
  pip install --upgrade keepercommander
  ```

  * see the [Nested Shared Folder CLI reference](/en/keeperpam/commander-cli/command-reference.md#nested-share-subfolders-commands).
* **System Requirements**
  * **JetBrains IDE**: Version **2024.3 or later** (IntelliJ IDEA, PyCharm, WebStorm, PhpStorm, RubyMine, CLion, GoLand, and other JetBrains IDEs on platform build 243+)
  * **Java**: Version 11 or later (provided by the IDE)
  * **HTTP Client** (optional): `.http` / `.rest` integration requires an IDE that bundles the JetBrains HTTP Client (e.g. IntelliJ IDEA Ultimate, WebStorm, GoLand). IntelliJ IDEA Community Edition does **not** include it; all other Keeper actions work normally on Community Edition
  * **Python**: Version 3.6+ (required for Keeper Commander CLI)

## Setup <a href="#configuring-discovery-credentials" id="configuring-discovery-credentials"></a>

### Installation

**Using JetBrains Marketplace**

1. Open your JetBrains IDE
2. Go to **File** → **Settings** → **Plugins** (or IntelliJ IDEA → Preferences → Plugins on macOS)
3. Search for "**Keeper Security**"
4. Click "**Install**" and restart the IDE

### Authentication

The plugin supports two authentication methods through Keeper Commander CLI:

**Method 1: Biometric Authentication**

```
# Login to Keeper
keeper shell

# Register biometric authentication
biometric register

# Follow prompts to set up biometric authentication
```

**Method 2: Persistent Login**

```markup
# Login to Keeper
keeper shell

# Register device for persistent login
this-device register

# Enable persistent login
this-device persistent-login on

# Verify configuration
this-device
```

#### Plugin Verification

1. Open any JetBrains IDE
2. Go to Tools → Keeper Vault → Check Keeper Authorization
3. Verify the authentication status shows success

## Usage <a href="#usage" id="usage"></a>

All Keeper actions are available through:

1. Tools Menu: Tools → Keeper Vault → \[Action]
2. Right-click Context Menu: Right-click in editor → \[Action]

### Available Commands

| Command                           | Description                                                                                                                            | Use Case                                                                 |
| --------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ |
| Check Keeper Authorization        | Verify Keeper CLI installation and authentication status                                                                               | Troubleshoot connection issues and verify setup                          |
| Get Keeper Secret                 | Insert existing secrets from vault as references (Classic or Nested Shared)                                                            | Retrieve stored secrets without exposing actual values                   |
| Add Keeper Record                 | Save selected text as a secret in vault and replace with reference (Classic or Nested Shared)                                          | Replace hardcoded secrets with vault references                          |
| Update Keeper Record              | Update an existing vault record by **record UID** and field name; routes to Classic or Nested Shared automatically                     | Modify existing secrets while maintaining references                     |
| Generate Keeper Secret            | Generate a secure password and store in vault (Classic or Nested Shared)                                                               | Create new secure credentials automatically                              |
| Get Keeper Folder                 | Select a **Classic** or **Nested Shared** folder for this project (searchable list with badges)                                        | Choose where new records are created for Add / Generate                  |
| Run Keeper Securely               | Execute a command with secrets injected from a `.env` file — Tools menu or saved run configuration under **Run → Edit Configurations** | Run applications or scripts with vault-backed environment variables      |
| Get Keeper Secret (in .http file) | Inserts `{{$keeper("uid","field")}}` at cursor in JetBrains HTTP Client request files (Ultimate / WebStorm / GoLand only)              | Inject vault secrets directly into HTTP requests without exposing values |

### Nested Shared Folders (plugin 2.0.2)

Keeper supports two vault models that appear together in the plugin:

* **Classic** — traditional vault folders and records (`record-add`, `record-update`, …)
* **Nested Shared Folder** — NSF folder and records (`nsf-record-add`, `nsf-record-update`, …)

The plugin picks the correct Commander command family from vault metadata. You do not choose Classic vs Nested manually for each operation.

**Folder and record pickers**

* **Get Keeper Folder** and **Get Keeper Secret** show Classic and Nested Shared items in one searchable dialog.
* Each row displays a **Classic** or **Nested** badge.
* Duplicate display names are resolved by record/folder UID internally — the row you click is the one used.

**Targeting a folder for new records**

1. Run **Tools → Keeper Vault → Get Keeper Folder** and pick a folder (Classic or Nested).
2. The selection is saved for the current project.
3. **Add Keeper Record** and **Generate Keeper Secret** create records in that folder using the matching command family.
4. **Get Keeper Folder is required** before Add or Generate. If no folder is saved for the project, those actions prompt you to run Get Keeper Folder first.

**Commander requirement**

Nested Shared Folder create/update flows need a recent Commander with `nsf-*` support. Upgrade with `pip install --upgrade keepercommander` if commands such as `nsf-record-add` are not recognized.

### Basic Secret Management

1. Retrieving Existing Secrets

```python
# Position cursor where you want the secret reference
database_password = |

# Use: Tools → Keeper Vault → Get Keeper Secret
# Search and select a record (Classic or Nested Shared; each row shows a badge)
# Choose the field from that record
# Result:
database_password = keeper://abc123def456/field/password
```

2. Adding New Secrets

```javascript
// Select the secret text
const apiKey = "sk-1234567890abcdef";

// Required first: Tools → Keeper Vault → Get Keeper Folder
// (pick a Classic or Nested Shared folder for the new record)
// Use: Right-click → Add Keeper Record
// Enter title and field name
// Result:
const apiKey = keeper://new-record-uid/field/api_key;
```

3. Generating Secure Passwords

```
# Position cursor
admin_password: |

# Required first: Tools → Keeper Vault → Get Keeper Folder
# (pick a Classic or Nested Shared folder for the new record)
# Use: Tools → Keeper Vault → Generate Keeper Secret
# Enter record title and field name
# Result:
admin_password: keeper://generated-record-uid/field/password
```

### Secure Command Execution

#### Environment **File Setup**

Create a `.env` file with Keeper references, for example:

```
DATABASE_URL=keeper://db-record-uid/field/connection_string
API_KEY=keeper://api-record-uid/field/key
SECRET_KEY=keeper://app-record-uid/field/secret
JWT_SECRET=keeper://auth-record-uid/field/jwt_key
```

{% hint style="info" %}
**Record UID format:** Values in `keeper://` references must use a valid Keeper record UID (22 URL-safe Base64 characters: `A-Z`, `a-z`, `0-9`, `_`, `-`). Invalid UIDs are skipped and reported as errors at run time.
{% endhint %}

**Running Commands with Injected Secrets**

**Option 1: Quick run (right-click action)**

1. Right-click in your project → Run Keeper Securely
2. Select or confirm the `.env` file
3. Enter your command (e.g., python3 app.py)
4. The plugin resolves secrets from the vault, runs the command, and shows output when the run completes (interactive Tools-menu flow). For repeat runs with full Run-tool-window history, use a saved **Run Keeper Securely** configuration (see Option 2).

```bash
# Plugin executes your command with actual values:
python3 app.py
# Environment contains:
# DATABASE_URL=postgresql://user:pass@host:5432/db
# API_KEY=ak_live_1234567890abcdef
# SECRET_KEY=super-secret-key-value
# JWT_SECRET=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
```

**Option 2: Saved Run Configuration (recommended for repeat runs)**

**Available since plugin version 1.1.0.**

1. Go to **Run → Edit Configurations… → + → Run Keeper Securely**
2. Fill in the three fields:
   * **Environment file (.env)** — path to your `.env` file containing `keeper://` references
   * **Working directory** — leave empty to use the project root
   * **Command** — the command to run (e.g. `python main.py`, `node app.js`)
3. Click **OK** and run with the standard Run/Debug toolbar buttons
4. Output and errors stream directly into the **Run tool window** — supports re-running, stopping, and full output history

{% hint style="info" %}
New configurations automatically prefill the Python interpreter (from project SDK or detected `venv`) and common entry scripts (`main.py` / `app.py` / `run.py`) when found in the project root.
{% endhint %}

#### Complete Workflow Example

```python
# 1. Start with hardcoded secrets (bad practice)
import os
import requests

DB_PASSWORD = "hardcoded_password_123"
API_TOKEN = "secret_api_token_xyz"

# 2. Select and replace with vault references
# Use: Add Keeper Record for each secret
DB_PASSWORD = keeper://db-creds-uid/field/password
API_TOKEN = keeper://api-creds-uid/field/token

# 3. Create .env file for secure execution
# .env contents:
# DB_PASSWORD=keeper://db-creds-uid/field/password
# API_TOKEN=keeper://api-creds-uid/field/token

# 4. Run application securely
# Use: Run Keeper Securely with command "python3 my_app.py"
```

### HTTP Client Integration

> **Available since plugin version 1.1.0.**
>
> **Requirement**: This feature requires an IDE that bundles the JetBrains HTTP Client plugin — IntelliJ IDEA Ultimate, WebStorm, or GoLand. IntelliJ IDEA Community Edition does **not** include it. The rest of the Keeper plugin works normally on Community.
>
> Nested Shared Folder records use the same `{{$keeper("RECORD_UID", "field-name")}}` syntax as Classic records — the UID is the Keeper record UID regardless of vault model.

The Keeper plugin registers a `$keeper` dynamic variable for the JetBrains HTTP Client. Use it in any `.http` or `.rest` file to reference a vault secret without typing the actual value.

#### Syntax

```http
{{$keeper("RECORD_UID", "field-name")}}
```

* `RECORD_UID` — the Keeper record UID (same as in `keeper://UID/field/...`)
* `field-name` — the field path (e.g. `password`, `login`, `custom.api_key`)

#### Example

#### Authenticated API call

```http
GET https://api.example.com/v1/resource
Authorization: Bearer {{$keeper("abc123def456", "password")}}
Content-Type: application/json
```

#### Basic auth

```http
POST https://api.example.com/v1/login
Content-Type: application/json 

{
    "username": "{{$keeper("abc123def456", "login")}}",
    "password": "{{$keeper("abc123def456", "password")}}"
}
```

#### Inserting via Get Keeper Secret

Instead of typing the UID manually:

1. Open a `.http` file and position the cursor where you want the reference
2. Tools → Keeper Vault → Get Keeper Secret (or right-click → Get Keeper Secret)
3. Search and select a record (`Classic` or `Nested Shared`; each row shows a badge), then choose the field
4. The plugin inserts `{{$keeper("uid","field")}}` automatically at the cursor

## Actions Reference <a href="#resources" id="resources"></a>

### Check Keeper Authorization <a href="#ksm_install" id="ksm_install"></a>

Verifies Keeper CLI installation and authentication status.

Usage: **Tools** → **Keeper Vault** → **Check Keeper Authorization**

Purpose: Troubleshoot connection issues and verify setup

### Get Keeper Secret <a href="#ksm_install" id="ksm_install"></a>

Retrieves existing secrets from vault as references.

**Usage:** Position cursor, then **Tools → Keeper Vault → Get Keeper Secret** (or right-click → **Get Keeper Secret**)

Properties:

* Input: Cursor position in editor
* Output: Keeper reference inserted at cursor — format depends on the file type:

| File type                           | Inserted format                          |
| ----------------------------------- | ---------------------------------------- |
| `.env`, `.py`, `.js`, scripts, etc. | `keeper://record-uid/field/field-name`   |
| `.http` / `.rest` (HTTP Client)     | `{{$keeper("record-uid","field-name")}}` |

* **Picker:** Searchable list of Classic and Nested Shared records; each row shows a **Classic** or **Nested** badge
* **HTTP Client:** Requires IntelliJ IDEA Ultimate, WebStorm, or GoLand

### Add Keeper Record <a href="#ksm_install" id="ksm_install"></a>

Creates a new vault record from selected text and replaces it with a reference.

**Usage:** Select text, then **right-click → Add Keeper Record** or **Tools → Keeper Vault → Add Keeper Record**

**Properties:**

* **Input:** Selected text containing a secret
* **Output:** Selected text replaced with a `keeper://` reference
* **Prompts:** Record title, field name
* **Folder targeting:** Run **Get Keeper Folder** first to store new records in a specific Classic or Nested Shared folder
* **Required:** Run **Get Keeper Folder** first and save a project folder. Add / Generate do not run without a saved folder.
* **Routing:** Classic folders use `record-add`; Nested Shared folders use `nsf-record-add`

### Update Keeper Record <a href="#ksm_install" id="ksm_install"></a>

Updates an existing vault record with a new value from selected text.

**Usage:** Select the new secret value (or place the caret on the value after `=`), then **right-click → Update Keeper Record**

**Properties:**

* **Input:** Selected text with the updated secret value
* **Prompts:** Keeper **record UID**, then **field name**
* **Validation:** The plugin validates the UID and confirms the record exists before updating
* **Output:** Text replaced with the existing record's `keeper://` reference
* **Routing:** Classic records use `record-update`; Nested Shared records use `nsf-record-update`

### Generate Keeper Secret <a href="#ksm_install" id="ksm_install"></a>

Generates a secure password and stores it in the vault.

**Usage:** Position cursor, then **Tools → Keeper Vault → Generate Keeper Secret** (or right-click → **Generate Keeper Secret**)

**Properties:**

* **Input:** Cursor position
* **Output:** Generated secure password reference inserted at cursor
* **Prompts:** Record title, field name
* **Folder targeting:** Run **Get Keeper Folder** first to create the record in a specific Classic or Nested Shared folder
* **Required:** Run **Get Keeper Folder** first and save a project folder. Add / Generate do not run without a saved folder.
* **Routing:** Classic folders use `record-add`; Nested Shared folders use `nsf-record-add`

### Get Keeper Folder <a href="#ksm_install" id="ksm_install"></a>

Selects a Classic or Nested Shared folder for organizing new records in the current project.

**Usage:** **Tools → Keeper Vault → Get Keeper Folder**

**Properties:**

* **Purpose:** Set the project folder used by **Add Keeper Record** and **Generate Keeper Secret**
* **Picker:** Searchable list of Classic and Nested Shared folders; each row shows a **Classic** or **Nested** badge
* **Scope:** Applies to the current project/workspace
* **Persistence:** Selection remembered across IDE sessions for that project
* **Routing:** Classic selection routes Add/Generate to `record-*`; Nested Shared selection routes to `nsf-*`

### Run Keeper Securely <a href="#ksm_install" id="ksm_install"></a>

Executes commands with secrets injected from .env file.

Usage: **Right-click in the editor** → **Run Keeper Securely** (or **Tools** → **Keeper Vault** → **Run Keeper Securely**)

Properties:

* **Input:** `.env` file with Keeper references
* **Process:** Fetches actual secret values from vault
* **Output:** Interactive run (Tools menu or editor right-click) shows output in a dialog when complete; saved Run Configuration streams output to the Run tool window
* **Security:** Secrets are resolved in memory and injected as environment variables; no secret values are written to disk. The subprocess environment is rebuilt from validated vault values plus a minimal whitelist of parent variables (such as `PATH` and `HOME`) — inherited IDE hook variables are not passed through
* **UID validation:** `keeper://` record UIDs in the `.env` file must be valid 22-character Keeper record UIDs; invalid entries are skipped with an error

**Option: Saved Run Configuration (Available since plugin version 1.1.0.)**

In addition to the right-click action, **Run Keeper Securely** is also available as a persistent run configuration type.

**Usage**: **Run → Edit Configurations → + → Run Keeper Securely**

Properties:

* **Environment file**: Path to the `.env` file with `keeper://` references (relative or absolute)
* **Working directory**: Directory the command runs in; empty defaults to the project root
* **Command**: Full command string (e.g. `python main.py`, `node server.js`, `./gradlew run`)
* **Output**: Streams to the Run tool window — supports stop, re-run, and scrollable history
* **Security**: Secrets are resolved in memory and injected as environment variables; no secret values are written to disk

## Platforms <a href="#platforms" id="platforms"></a>

The following platforms are supported:

* Linux: Ubuntu 18.04+, CentOS 7+, RHEL 7+, Debian 9+, Fedora 30+
* macOS: 10.14+ (Mojave and later)
* Windows: Windows 10+, Windows Server 2016+

## Requirements <a href="#requirements" id="requirements"></a>

### JetBrains IDEs <a href="#chef-1" id="chef-1"></a>

* IntelliJ IDEA: **2024.3+**
* PyCharm: **2024.3+**
* WebStorm: **2024.3+**
* PhpStorm: **2024.3+**
* RubyMine: **2024.3+**
* CLion: **2024.3+**
* GoLand: **2024.3+**
* DataGrip: **2024.3+**
* Rider: **2024.3+**

### Dependencies <a href="#dependencies" id="dependencies"></a>

* Java Runtime: 11+ (provided by JetBrains IDE)
* Python: 3.6+ (for Keeper Commander CLI)
* pip: Latest version (for CLI installation)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://newdocs.keeper.io/en/keeperpam/secrets-manager/integrations/jetbrains-plugin.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.