kindgi tokens

`kindgi tokens`

Synopsis

kindgi tokens <command>

Signature

API keys for you, a person or a service account: create (its secret shown once), list, get, revoke.

Commands

Command	Description
`kindgi tokens create`	Create an API key, for you or (a tenant admin) for someone else.
`kindgi tokens list`	List API keys, newest first, revoked ones included; never secrets.
`kindgi tokens get`	One API key, by id.
`kindgi tokens revoke`	Revoke an API key: from its next request on, it is refused.

See also

People, API keys and service accounts

`kindgi tokens create`

Synopsis

kindgi tokens create [--for=user:<id>|sa:<id>] [--role=member|admin] [--project=<project-id>] [--expires=30d|<iso-date>] [--label=<text>] [--capability=<cap>]…

Signature

Create an API key, for you or (a tenant admin) for someone else. Its secret is printed once, here: store it now, nothing shows it again. A member key takes no admin action on the tenant; a key limited to a project acts only there.

Options

Option	Default	Description
`--capability <value>`	none	A capability it carries (repeatable); you must hold it. Repeatable.
`--expires <value>`	none	When it stops working: `30d`, `12h`, `90m` from now, or an ISO date.
`--for <value>`	none: the key is for you	Whom it acts for: `user:<id>` or `sa:<service-account-id>` (default: you).
`--label <value>`	none	What the key is for, e.g. `ci`.
`--project <value>`	none	Limit the key to this project.
`--role <value>`	`member`	`member` (the default) or `admin` (needs a tenant admin, for one).

Every command also takes the global flags.

Examples

From People, API keys and service accounts:

npx --yes @kindgi/cli@0.1 tokens create --for=sa:<service-account-id> --role=admin --capability=signing-keys:write --capability=secrets:write --label=deploy --expires=90d
npx --yes @kindgi/cli@0.1 tokens create --label=laptop --expires=30d

See also

`kindgi tokens list`

Synopsis

kindgi tokens list [--for=user:<id>|sa:<id>] [--limit=<n>] [--cursor=<c>] [--table]

Signature

List API keys, newest first, revoked ones included; never secrets. A tenant admin sees every key (--for narrows to one principal); anyone else, their own.

Options

Option	Default	Description
`--cursor <value>`	none	Resume after this cursor, from the previous page's `nextCursor`.
`--for <value>`	none	Only this principal's keys (tenant admins).
`--limit <value>`	`25` (at most `100`)	The most keys to return.

Every command also takes the global flags.

Examples

From People, API keys and service accounts:

npx --yes @kindgi/cli@0.1 tokens list --table

See also

`kindgi tokens get`

Synopsis

kindgi tokens get <token-id>

Signature

One API key, by id. No secret.

Options

Every command also takes the global flags.

Examples

Show one API key, without its secret.

kindgi tokens get <token-id>

See also

`kindgi tokens revoke`

Synopsis

kindgi tokens revoke <token-id>

Signature

Revoke an API key: from its next request on, it is refused.

Options

Every command also takes the global flags.

Examples

Revoke an API key.

kindgi tokens revoke <token-id>

See also