# kindgi key

> Manage Ed25519 signing keys: the local pairs under ~/.kindgi/keys/, and the runtime's trust list

## `kindgi key`

**Synopsis**

```sh signature
kindgi key <command>
```

Manage Ed25519 signing keys: the local pairs under \~/.kindgi/keys/, and the runtime's trust list.

**Commands**

| Command                                                                                       | Description                                                                                             |
| --------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
| [`kindgi key create`](https://docs.kindgi.com/v0.1.10/reference/cli/key.md#kindgi-key-create) | Generate a new Ed25519 keypair under \~/.kindgi/keys/.                                                  |
| [`kindgi key export`](https://docs.kindgi.com/v0.1.10/reference/cli/key.md#kindgi-key-export) | Print the PUBLIC key material for a local key.                                                          |
| [`kindgi key list`](https://docs.kindgi.com/v0.1.10/reference/cli/key.md#kindgi-key-list)     | List local Ed25519 keys under \~/.kindgi/keys/.                                                         |
| [`kindgi key trust`](https://docs.kindgi.com/v0.1.10/reference/cli/key.md#kindgi-key-trust)   | Add a local key's public key to the runtime's trust list, so the runtime accepts deploys the key signs. |
| [`kindgi key revoke`](https://docs.kindgi.com/v0.1.10/reference/cli/key.md#kindgi-key-revoke) | Remove a key from the runtime's trust list: the runtime refuses new deploys it signs.                   |

**See also**

- [Deploy on Azure Container Apps](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/azure-container-apps.md)
- [Deploy on Google Cloud Run](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/cloud-run.md)
- [Rotate the runtime's tokens and keys](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/rotate-keys.md)
- [Self-host Kindgi](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/self-host.md)

### `kindgi key create`

**Synopsis**

```sh signature
kindgi key create <keyId> [--env <name>] [--home <dir>]
```

Generate a new Ed25519 keypair under \~/.kindgi/keys/.

**Options**

| Option           | Default                                                     | Description                                                                                         |
| ---------------- | ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------- |
| `--env <value>`  | none                                                        | Also print the `signingKey` and `signerKeyId` lines to add to this env block in `kindgi.config.ts`. |
| `--home <value>` | `$HOME` (then the context home, then the OS home directory) | The home directory whose `.kindgi/keys/` holds the keys. Default: `$HOME`.                          |

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.10/reference/cli.md#global-flags).

**Examples**

From [Rotate the runtime's tokens and keys](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/rotate-keys.md):

```sh
npx --yes @kindgi/cli@0.1 key create acme-selfhost-2 --env selfhost
```

From [Self-host Kindgi](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/self-host.md):

```sh
npx --yes @kindgi/cli@0.1 key create acme-selfhost --env selfhost
```

**See also**

- [Rotate the runtime's tokens and keys](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/rotate-keys.md)
- [Self-host Kindgi](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/self-host.md)
- [Deploy your agent to Kindgi Cloud](https://docs.kindgi.com/v0.1.10/hosted/deploy-your-agent.md)
- [`kindgi key`](https://docs.kindgi.com/v0.1.10/reference/cli/key.md#kindgi-key)

### `kindgi key export`

**Synopsis**

```sh signature
kindgi key export <keyId> [--format=pem|base64|raw-hex] [--home <dir>]
```

Print the PUBLIC key material for a local key. Never exports the private key.

**Options**

| Option             | Default                                                     | Description                                                                |
| ------------------ | ----------------------------------------------------------- | -------------------------------------------------------------------------- |
| `--format <value>` | `pem`                                                       | The public key's encoding: `pem` (default), `base64` or `raw-hex`.         |
| `--home <value>`   | `$HOME` (then the context home, then the OS home directory) | The home directory whose `.kindgi/keys/` holds the keys. Default: `$HOME`. |

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.10/reference/cli.md#global-flags).

**Examples**

Print a key's public half as PEM.

```sh
kindgi key export acme-selfhost
```

Print it as base64.

```sh
kindgi key export acme-selfhost --format=base64
```

**See also**

- [Deploy on Azure Container Apps](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/azure-container-apps.md)
- [Deploy on Google Cloud Run](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/cloud-run.md)
- [Rotate the runtime's tokens and keys](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/rotate-keys.md)
- [Self-host Kindgi](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/self-host.md)
- [`kindgi key`](https://docs.kindgi.com/v0.1.10/reference/cli/key.md#kindgi-key)

### `kindgi key list`

**Synopsis**

```sh signature
kindgi key list [--home <dir>]
```

List local Ed25519 keys under \~/.kindgi/keys/.

**Options**

| Option           | Default                                                     | Description                                                                |
| ---------------- | ----------------------------------------------------------- | -------------------------------------------------------------------------- |
| `--home <value>` | `$HOME` (then the context home, then the OS home directory) | The home directory whose `.kindgi/keys/` holds the keys. Default: `$HOME`. |

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.10/reference/cli.md#global-flags).

**Examples**

List the local signing keys.

```sh
kindgi key list
```

**See also**

- [Deploy on Azure Container Apps](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/azure-container-apps.md)
- [Deploy on Google Cloud Run](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/cloud-run.md)
- [Rotate the runtime's tokens and keys](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/rotate-keys.md)
- [Self-host Kindgi](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/self-host.md)
- [`kindgi key`](https://docs.kindgi.com/v0.1.10/reference/cli/key.md#kindgi-key)

### `kindgi key trust`

**Synopsis**

```sh signature
kindgi key trust <keyId> [--label <text>] [--home <dir>]
```

Add a local key's public key to the runtime's trust list, so the runtime accepts deploys the key signs.

**Options**

| Option            | Default                                                     | Description                                                                |
| ----------------- | ----------------------------------------------------------- | -------------------------------------------------------------------------- |
| `--home <value>`  | `$HOME` (then the context home, then the OS home directory) | The home directory whose `.kindgi/keys/` holds the keys. Default: `$HOME`. |
| `--label <value>` | none                                                        | A label the runtime keeps with the key (up to 200 characters).             |

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.10/reference/cli.md#global-flags).

**Examples**

From [Deploy on Azure Container Apps](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/azure-container-apps.md):

```sh
npx --yes @kindgi/cli@0.1 key trust acme-dev --label dev --url "$URL"
```

From [Deploy on Google Cloud Run](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/cloud-run.md):

```sh
npx --yes @kindgi/cli@0.1 key trust acme-prod --url "$URL"
```

**See also**

- [Deploy on Azure Container Apps](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/azure-container-apps.md)
- [Deploy on Google Cloud Run](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/cloud-run.md)
- [Rotate the runtime's tokens and keys](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/rotate-keys.md)
- [Self-host Kindgi](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/self-host.md)
- [`kindgi key`](https://docs.kindgi.com/v0.1.10/reference/cli/key.md#kindgi-key)

### `kindgi key revoke`

**Synopsis**

```sh signature
kindgi key revoke <keyId> [--reason <text>]
```

Remove a key from the runtime's trust list: the runtime refuses new deploys it signs.

**Options**

| Option             | Default | Description                                |
| ------------------ | ------- | ------------------------------------------ |
| `--reason <value>` | none    | Why, kept with the key as `revokedReason`. |

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.10/reference/cli.md#global-flags).

**Examples**

From [Rotate the runtime's tokens and keys](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/rotate-keys.md):

```sh
npx --yes @kindgi/cli@0.1 key revoke acme-selfhost --reason "rotated to acme-selfhost-2" \
```

**See also**

- [Rotate the runtime's tokens and keys](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/rotate-keys.md)
- [`kindgi key`](https://docs.kindgi.com/v0.1.10/reference/cli/key.md#kindgi-key)