Stado

CLI reference / credentials

stado credentials

Invocation

stado credentials <COMMAND>

Purpose

Read, migrate, and manage application credentials in the selected store

Required inputs and options

This command has no command-specific inputs or options.

Output and state effect

This command group selects one of the subcommands listed below; use its exact child invocation to perform an operation.

Refusals

  • Before dispatch, Stado refuses a missing required token shown in the invocation, an unknown option, or a value outside a listed value set; argument-usage failures exit with code 2.

Subcommands

  • put — Store an item in the selected credential store, reading from STDIN
  • get — Print one credential item value or one exact string field to stdout, naming the item by its id or by the role it plays
  • ls — List metadata for items visible to the credential-store admin
  • rm — Delete one item from the selected credential store
  • migrate — Move every credential to a new backend and commit the selector
  • doctor — Report whether any key on this machine can still open the vault, and which key files a restore needs when none can
  • vault — The Skarbiec vault: which one this machine resolves to (`show`), which the fleet holds (`list`), what one holds (`items`), and keeping copies in step with the owner (`sync`, `retire`)
  • harvest — Inventory credentials recoverable from agent transcripts. Reports names and counts, never values
  • try-unlock — Test unlock phrases found in transcripts against a local or remote vault, reporting which source name worked. Never prints a phrase
  • item — Credential item operations on the host that owns the vault
  • token — Credential token operations on the host that owns the vault
  • acquisition-scopes — Acquisition-scope operations on a host vault
  • grant — Consumer grant operations on a host vault
  • backup — Backup operations associated with credential custody
  • seed — Authenticator seeds in login rows: list whether each row still holds a seed its account accepts, or enrol one for a row that has none
  • sparkle-key — A desktop product's Sparkle update key
  • signing-profile — A product's code-signing provisioning profiles, stored as fields of one owner-vault item