bunker

Manage nostr bunker connections and nbunks (NIP-46 remote signing).

Usage

nsyte bunker <subcommand> [options]

Subcommands

• connect [url] — Connect to a bunker URL and store as nbunksec
• list — List all stored bunkers in the system
• import [nbunksec] — Import a bunker from an nbunksec string
• export [pubkey] — Export a bunker as an nbunksec string
• use [pubkey] — Configure current project to use a bunker
• remove [pubkey] — Remove a bunker from storage
• migrate [...pubkeys] — Rebuild index for keychain bunkers (macOS only)

export, use, remove and migrate accept a hex pubkey, npub, nprofile or NIP-05 identifier (e.g. alice@example.com), matching either the user pubkey or the remote signer pubkey. remove also tells the bunker the session is ending (best effort, 2s timeout).

• help — Show detailed help information

Examples

Connect to a bunker interactively:

nsyte bunker connect

Connect to a bunker with a URL:

nsyte bunker connect 'bunker://pubkey?relay=wss://relay.example&secret=xxx'

Connect without storing (ephemeral):

nsyte bunker connect --no-persist

Connect with forced encrypted storage:

nsyte bunker connect --force-encrypted-storage

List all bunkers:

nsyte bunker list

Import a bunker from an nbunksec string:

nsyte bunker import <nbunksec>

Export a bunker as an nbunksec string:

nsyte bunker export <pubkey>

Use a bunker for the current project:

nsyte bunker use <pubkey>

Remove a bunker from storage:

nsyte bunker remove <pubkey>

Rebuild bunker index (macOS only):

nsyte bunker migrate

Migrate specific bunkers:

nsyte bunker migrate <pubkey1> <pubkey2>

Bunker Migration

The migrate subcommand rebuilds the bunker index on macOS by scanning project .nsite/config.json files for bunkerPubkey values and checking the macOS keychain (via the security tool) for each.

When to Use

• After manually adding bunkers to the keychain
• If bunker list is not showing all bunkers
• After upgrading from an older version of nsyte
• When experiencing keychain access issues

How it Works

1. Auto-discovery: Scans the system keychain for stored bunkers
2. Index rebuild: Creates or updates the encrypted index
3. Verification: Validates each discovered bunker
4. Summary: Shows count of migrated bunkers

Manual Migration

If auto-discovery fails, you can manually specify pubkeys:

nsyte bunker migrate abc123... def456...

The migration creates a completion marker to prevent re-running unnecessarily.

Connect Options

The top-level nsyte bunker command takes no per-command options of its own (only globals). The options below apply to the connect subcommand (nsyte bunker connect):

• --pubkey <pubkey> — Bunker public key (alternative to full URL)
• --relay <relay> — Relay URL(s), comma separated (alternative to full URL). wss:// is added when the protocol is omitted, as for all relay inputs
• --secret <secret> — Connection secret (alternative to full URL)
• --persist — Store nbunksec for future use (default: true)
• --no-persist — Don't store nbunksec (ephemeral connection for CI/CD; auto-generated by Cliffy as the negation of --persist)
• --force-encrypted-storage — Force encrypted file storage instead of OS keychain (default: false)

Connection Methods

Interactive QR Scan: Displays QR code for scanning with bunker app

Manual URL: Paste bunker URL from your bunker provider

Component-based: Provide --pubkey, --relay, and optionally --secret separately

See Also

• nsyte ci - Create ephemeral bunker credentials for CI/CD
• Security Guide - Bunker security best practices

Inherits global options. See global options.