Stado
On this page

Credential operations

Credential operations is the single Stado surface for inspecting and changing the Skarbiec vault held by a fleet host. The host is always named with --host; credential values remain on stdin or in an owner-only file and never enter a local or remote process argument vector.

Invocations

  • stado credentials item put --host <TARGET> <ITEM> --type <KIND> [--json] reads the canonical JSON item from stdin.
  • stado credentials item show --host <TARGET> <ITEM> [--field <FIELD>] [--json] reports metadata, length and SHA-256, never field values.
  • stado credentials item retag --host <TARGET> <ITEM> [--tags <COMMA-SEPARATED-TAGS>] [--json]; omitting --tags is read-only.
  • stado credentials token mint --host <TARGET> <CONSUMER> --capabilities <CAPABILITIES> --audience <AUDIENCE> [--ttl-seconds <SECONDS>] [--replace-capabilities] [--token-item <ITEM> --token-field <FIELD> | --raw-token | --token-file-name <NAME>] [--json].
  • stado credentials vaults [--host <TARGET>] [--json] lists nonsecret vault counts and the declared authority for one host or the fleet.
  • stado credentials vault sync --host <TARGET> [--check] [--json]; --check reports conflicts and loss without replacing the live vault.
  • stado credentials acquisition-scopes sync --host <TARGET> <SOURCE> delivers and registers the checked-in catalog.
  • stado credentials grant item-read --host <TARGET> <CONSUMER> <ITEM> --field <FIELD> --token-file <TARGET-PATH> [--json] names the bearer file on the target and never reads its bytes into argv.
  • stado credentials grant show --host <TARGET> <CONSUMER> [--token-file <TARGET-PATH>] [--json] reports capabilities and whether the named file carries the recorded bearer.
  • stado credentials backup audit --host <TARGET> [--object <STADO-URI> ... | --inventory-namespace <NAMESPACE> ...] [--reclaim-twins [--apply]] [--json].
  • stado credentials seed-freshness --host <TARGET> [--login-item <ITEM>] [--json] joins nonsecret TOTP seed state with sign-in evidence.

stado credentials vault [--json] remains the local-machine vault-authority report.

Declaration

Every host operation first reads the host's effective Stado configuration with the same remote stado config show path used by host config-show. The authority is resolved.skarbiec_vault_file, sourced from secrets.skarbiec.vault_file (or its SKARBIEC_VAULT_FILE configuration override). $HOME/ is expanded against the target account. No conventional vault path is guessed when the declaration is absent.

Refusals

  • <target> declares no vault authority; add it to secrets.skarbiec.vault_file
  • <target> declares no credential item <item>; add it to the vault declared by secrets.skarbiec.vault_file
  • <target> declares no grant for <consumer>; add it to the vault declared by secrets.skarbiec.vault_file

Other operation-specific refusals retain Skarbiec's actionable sentence and name the host, item, grant, catalog, mirror, backup object or seed evidence that could not be read or changed.

Replaced host verbs

  • host vault-item-put
  • host vault-item-show
  • host vault-token-mint
  • host vaults
  • host retag-vault-item
  • host sync-vault
  • host sync-acquisition-scopes
  • host grant-item-read
  • host grant-show
  • host backup-audit
  • host authenticator-seed-freshness

Stado Desktop

The Hosts inspector contains a Credentials section. It reads stado credentials vaults --host <TARGET> --json, renders the authority state, declared path and number of vault files seen, displays the command's refusal when the declaration is absent, and opens the existing bounded-bearer sheet. That sheet now invokes stado credentials token mint --host <TARGET> and renders only nonsecret receipt fields unless the operator explicitly requests the one-time raw-token reveal.

Source: this website