tai keys bootstrap
Mint the FIRST admin API key on a fresh deployment — runs WITHOUT a credential.
Access control ON with no key yet has no authenticated door to mint the first key;
this is the one-shot public door. Gated by the boot-time bootstrap token; refused
once any key exists. The raw sk-… value is printed ONCE — capture it now.
Example: tai keys bootstrap --user alice --description 'root key' --token -
tai keys claim-link
Mint a one-time claim link that carries a key you hold to another device.
The link’s token rides the URL FRAGMENT (/login#claim=<token>) and is
SINGLE-USE — the first exchange burns it. Prints the claim path and expiry; compose
the absolute URL (or a QR) from your own origin.
Example: tai keys claim-link sk-abc123 --ttl 300
tai keys create
Provision an API key; the raw sk-… value is printed ONCE.
Example: tai keys create --user alice --description 'CI key' --scope read
tai keys delete
Revoke a key (immediate: the next request fails to auth).
Revoking also STOPS every hook and trigger link bound to this key as its
execution_key — their next fire is refused. Run tai hooks list and
tai hooks trigger-links first to see which records bind it.
Example: tai keys delete alice
tai keys edit
Partially edit a key’s description/scopes/policy in place (no rotation).
Only the flags you pass are written; omitted fields are preserved. --clear-condition
sends the explicit reset (condition: null) that drops the key’s gate, distinct from
omitting the flag entirely.
De-scoping this key (or its owner) also NARROWS what every hook and trigger link
bound to it as its execution_key may call at its next fire — see tai hooks list for which records bind it.
Example: tai keys edit alice --scope read --scope write
tai keys list
List every provisioned key’s identity and policy (never key material).
Example: tai keys list
tai keys policy-rollback
Roll a user’s enforced policy back to a prior version.
Example: tai keys policy-rollback alice 2
tai keys policy-versions
List a user’s append-only policy version history.
Example: tai keys policy-versions alice
tai keys scopes
Add and/or remove individual scopes on a key WITHOUT replacing the whole set.
At least one —add or —remove is required. This is the granular complement of
tai keys edit --scope, which replaces the entire scope set at once.
Example: tai keys scopes alice --add write --remove read
tai keys validate-condition
Compile (and optionally sample-evaluate) a jq policy condition without saving.
Example: tai keys validate-condition --condition '{"content": ".method == \"GET\""}'