My goal is to make a daily backup of my Bitwarden vault using restic. I also don’t want to store my master password on disk, which means backing up the encrypted vault.
The solution to do that is to use a Bitwarden API key. API keys do not seem to have the capability to decrypt the vault, as you need to enter your master password yourself to unlock the vault before viewing items, which makes them the perfect tool for the job.
The Bitwarden CLI can use this key to log in to your account, which will allow it to download the vault using bw sync to ~/.config/Bitwarden CLI/data.json.
You can then backup this file using restic. Personally, I use this script with a daily systemd timer to have backup notifications, but the regular restic binary will also do the trick.