# kindgi tokens

> API keys for you, a person or a service account: create (its secret shown once), list, get, revoke

## `kindgi tokens`

**Synopsis**

```sh signature
kindgi tokens <command>
```

API keys for you, a person or a service account: create (its secret shown once), list, get, revoke.

**Commands**

| Command                                                                                               | Description                                                        |
| ----------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ |
| [`kindgi tokens create`](https://docs.kindgi.com/v0.1.8/reference/cli/tokens.md#kindgi-tokens-create) | Create an API key, for you or (a tenant admin) for someone else.   |
| [`kindgi tokens list`](https://docs.kindgi.com/v0.1.8/reference/cli/tokens.md#kindgi-tokens-list)     | List API keys, newest first, revoked ones included; never secrets. |
| [`kindgi tokens get`](https://docs.kindgi.com/v0.1.8/reference/cli/tokens.md#kindgi-tokens-get)       | One API key, by id.                                                |
| [`kindgi tokens revoke`](https://docs.kindgi.com/v0.1.8/reference/cli/tokens.md#kindgi-tokens-revoke) | Revoke an API key: from its next request on, it is refused.        |

**See also**

- [People, API keys and service accounts](https://docs.kindgi.com/v0.1.8/deploy/people-and-keys.md)

### `kindgi tokens create`

**Synopsis**

```sh signature
kindgi tokens create [--for=user:<id>|sa:<id>] [--role=member|admin] [--project=<project-id>] [--expires=30d|<iso-date>] [--label=<text>] [--capability=<cap>]…
```

Create an API key, for you or (a tenant admin) for someone else. Its secret is printed once, here: store it now, nothing shows it again. A `member` key takes no admin action on the tenant; a key limited to a project acts only there.

**Options**

| Option                 | Default                  | Description                                                                |
| ---------------------- | ------------------------ | -------------------------------------------------------------------------- |
| `--capability <value>` | none                     | A capability it carries (repeatable); you must hold it. Repeatable.        |
| `--expires <value>`    | none                     | When it stops working: `30d`, `12h`, `90m` from now, or an ISO date.       |
| `--for <value>`        | none: the key is for you | Whom it acts for: `user:<id>` or `sa:<service-account-id>` (default: you). |
| `--label <value>`      | none                     | What the key is for, e.g. `ci`.                                            |
| `--project <value>`    | none                     | Limit the key to this project.                                             |
| `--role <value>`       | `member`                 | `member` (the default) or `admin` (needs a tenant admin, for one).         |

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.8/reference/cli.md#global-flags).

**Examples**

From [People, API keys and service accounts](https://docs.kindgi.com/v0.1.8/deploy/people-and-keys.md):

```sh
npx --yes @kindgi/cli@0.1 tokens create --for=sa:<service-account-id> --role=admin --capability=signing-keys:write --capability=secrets:write --label=deploy --expires=90d
npx --yes @kindgi/cli@0.1 tokens create --label=laptop --expires=30d
```

**See also**

- [People, API keys and service accounts](https://docs.kindgi.com/v0.1.8/deploy/people-and-keys.md)
- [`kindgi tokens`](https://docs.kindgi.com/v0.1.8/reference/cli/tokens.md#kindgi-tokens)

### `kindgi tokens list`

**Synopsis**

```sh signature
kindgi tokens list [--for=user:<id>|sa:<id>] [--limit=<n>] [--cursor=<c>] [--table]
```

List API keys, newest first, revoked ones included; never secrets. A tenant admin sees every key (`--for` narrows to one principal); anyone else, their own.

**Options**

| Option             | Default              | Description                                                      |
| ------------------ | -------------------- | ---------------------------------------------------------------- |
| `--cursor <value>` | none                 | Resume after this cursor, from the previous page's `nextCursor`. |
| `--for <value>`    | none                 | Only this principal's keys (tenant admins).                      |
| `--limit <value>`  | `25` (at most `100`) | The most keys to return.                                         |

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.8/reference/cli.md#global-flags).

**Examples**

From [People, API keys and service accounts](https://docs.kindgi.com/v0.1.8/deploy/people-and-keys.md):

```sh
npx --yes @kindgi/cli@0.1 tokens list --table
```

**See also**

- [People, API keys and service accounts](https://docs.kindgi.com/v0.1.8/deploy/people-and-keys.md)
- [`kindgi tokens`](https://docs.kindgi.com/v0.1.8/reference/cli/tokens.md#kindgi-tokens)

### `kindgi tokens get`

**Synopsis**

```sh signature
kindgi tokens get <token-id>
```

One API key, by id. No secret.

**Options**

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.8/reference/cli.md#global-flags).

**Examples**

Show one API key, without its secret.

```sh
kindgi tokens get <token-id>
```

**See also**

- [People, API keys and service accounts](https://docs.kindgi.com/v0.1.8/deploy/people-and-keys.md)
- [`kindgi tokens`](https://docs.kindgi.com/v0.1.8/reference/cli/tokens.md#kindgi-tokens)

### `kindgi tokens revoke`

**Synopsis**

```sh signature
kindgi tokens revoke <token-id>
```

Revoke an API key: from its next request on, it is refused.

**Options**

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.8/reference/cli.md#global-flags).

**Examples**

Revoke an API key.

```sh
kindgi tokens revoke <token-id>
```

**See also**

- [People, API keys and service accounts](https://docs.kindgi.com/v0.1.8/deploy/people-and-keys.md)
- [`kindgi tokens`](https://docs.kindgi.com/v0.1.8/reference/cli/tokens.md#kindgi-tokens)