CLI reference / credentials

stado credentials

Invocation

stado credentials <COMMAND>

Purpose

Read, migrate, and manage application credentials in the selected store

Required inputs and options

This command has no command-specific inputs or options.

Output and state effect

This command group selects one of the subcommands listed below; use its exact child invocation to perform an operation.

Refusals

• Before dispatch, Stado refuses a missing required token shown in the invocation, an unknown option, or a value outside a listed value set; argument-usage failures exit with code 2.

Subcommands

• put — Store an item in the selected credential store, reading from STDIN
• get — Print one credential item value or one exact string field to stdout
• ls — List metadata for items visible to the credential-store admin
• rm — Delete one item from the selected credential store
• migrate — Move every credential to a new backend and commit the selector
• mint-acquisition-token — Mint one request-only bootstrap token directly into an owner-only file
• doctor — Report whether any key on this machine can still open the vault, and which key files a restore needs when none can
• vault — Report which vault this machine's credential operations resolve to, and why
• inspect-vault — List nonsecret item metadata from one owner-controlled vault file
• bootstrap-weles — Recreate Weles internal authorities in the canonical owner vault from surviving owner credentials
• adopt-weles-vault — Merge the retired Weles-dedicated vault into the canonical owner vault
• harvest — Inventory credentials recoverable from agent transcripts. Reports names and counts, never values
• try-unlock — Test unlock phrases found in transcripts against a local or remote vault, reporting which source name worked. Never prints a phrase
• item — Credential item operations on the host that owns the vault
• token — Credential token operations on the host that owns the vault
• vaults — Which Skarbiec vaults the fleet holds
• acquisition-scopes — Acquisition-scope operations on a host vault
• grant — Consumer grant operations on a host vault
• backup — Backup operations associated with credential custody
• seed-freshness — Whether login items still hold authenticator seeds their accounts accept