tai keys claim-link
Mint a one-time claim link that carries a key you hold to another device.
The link’s token rides the URL FRAGMENT (/login#claim=<token>) and is
SINGLE-USE — the first exchange burns it. Prints the claim path and expiry; compose
the absolute URL (or a QR) from your own origin.
Example: tai keys claim-link sk-abc123 --ttl 300
tai keys create
Provision an API key; the raw sk-… value is printed ONCE.
Example: tai keys create --user alice --description 'CI key' --scope read
tai keys delete
Revoke a key (immediate: the next request fails to auth).
Example: tai keys delete alice
tai keys edit
Partially edit a key’s description/scopes/policy in place (no rotation).
Only the flags you pass are written; omitted fields are preserved. Pass an
empty value to clear an optional condition gate.
Example: tai keys edit alice --scope read --scope write
tai keys list
List every provisioned key’s identity and policy (never key material).
Example: tai keys list
tai keys policy-rollback
Roll a user’s enforced policy back to a prior version.
Example: tai keys policy-rollback alice 2
tai keys policy-versions
List a user’s append-only policy version history.
Example: tai keys policy-versions alice
tai keys validate-condition
Compile (and optionally sample-evaluate) a jq policy condition without saving.
Example: tai keys validate-condition --condition '.method == "GET"'