--display-name <str> | The owner principal’s display name (required to initialize). |
--token <str> | The setup token, or ’-’ to read it from stdin. The server auto-generates one and prints it in its startup log unless you set TAI_SETUP_TOKEN yourself, or the door is unavailable and mints none — access control off, no key-minting identity provider, or the access-control Redis unset (those three are also the 501 the door answers). Falls back to TAI_SETUP_TOKEN, then an interactive prompt. |
--user <str> | The owner principal’s id (omitted = server-minted). |
--key-user <str> | The owner key’s id (omitted = server-minted). |
--key-description <str> | The owner key’s description. (default: owner key) |
--password <str> | Set the owner’s password now (needs —email). |
--password-file <str> | Read the owner’s password from a file, or from stdin when the path is ’-’, instead of putting a secret on the command line (a value on argv leaks via ps and shell history). |
--invite | Attach the owner’s login via a one-time invite link instead of a password. (default: False) |
--no-login | Keys-only: create the owner and its key, attach no login. (default: False) |
--email <str> | The owner’s email (required with —password/—invite). |
--recover | Re-mint the owner’s key when the deployment is initialized but no owner key can authenticate (host-side: reads the deployment’s manifest and stores; needs the setup token). (default: False) |
--manifest-path <str> | With —recover: the deployment’s manifest (default: TAI_MANIFEST_PATH). |
