bw sync: Refresh the Bitwarden Vault Cache
bw sync downloads the current vault from the Bitwarden server so local reads reflect recent changes.
The Bitwarden CLI caches the vault locally. In a fresh CI runner that cache can be empty or stale, so bw sync after unlock ensures bw get returns the latest secrets.
What it does
bw sync fetches the up-to-date vault contents from the server and refreshes the local encrypted cache. It requires an unlocked session so it can re-encrypt the data locally.
Common usage
export BW_SESSION="$(bw unlock --passwordenv BW_PASSWORD --raw)"
bw sync
bw sync --last # print the time of the last syncOptions
| Flag | What it does |
|---|---|
| --last | Print the last sync timestamp instead of syncing |
| --session <key> | Session key (or set BW_SESSION) |
| -f, --force | Force a full sync even if one is not due |
In CI
Run bw sync right after bw unlock in every job, since a runner starts with no vault cache. A recently rotated secret that a job cannot find is almost always a missing sync.
Common errors in CI
"Vault is locked." means BW_SESSION is not set or expired; unlock again. "You are not logged in." means bw login has not run. A successful sync that still lacks a secret means the account or collection does not have access to that item.