q-ring 101

q-ring 101 is a short tutorial series on q-ring, the command-line secrets manager and MCP server from I4C Studio. Nine episodes, one command each, none longer than 40 seconds. Each episode page pairs the video with its transcript and a written walkthrough: what the command does, an example you can copy, the risk it removes, and the gotchas the docs call out.

Who it is for

Developers who keep API keys in .env files or shell profiles and now run AI coding agents, such as Claude Code, Cursor, or Kiro, with filesystem and shell access. No security background needed. If you can run npm install, you can follow along.

Follow along

npm install -g @i4ctime/q-ring    # or: brew install i4ctime/tap/qring
qring doctor                      # confirms the keychain works before you start

Use throwaway values while you practice. The episodes were recorded with fake DEMO_ keys for the same reason.

Episodes

1. Store a secret (qring set): move a key into the OS keychain and list it without printing it.
2. One key, every environment (qring inspect): separate dev, staging, and prod values under one name.
3. Run without leaking (qring exec): inject secrets into a command and redact them from its output.
4. Rotate once, everywhere (qring entangle): link copies so one write updates them all.
5. Secrets that expire (qring set --ttl): give keys a lifetime that q-ring enforces.
6. Move a vault (qring teleport): carry secrets to a new machine in one encrypted bundle.
7. Leave .env behind (qring import): migrate an existing .env file in one command.
8. Prove who read what (qring audit): a hash-chained log of every access, and how to verify it.
9. Agents on a leash (qring policy): rules and approvals for what AI agents can touch.

Episodes 1 to 3 cover daily use, 4 to 7 the lifecycle of a key, and 8 and 9 oversight once agents are involved. Every command and flag is in the CLI reference.