stado credentials token mint
Invocation
stado credentials token mint [OPTIONS] --host <HOST> --capabilities <CAPABILITIES> --audience <AUDIENCE> <CONSUMER>Purpose
Mint a Skarbiec bearer, or register an existing vault field
Required inputs and options
| Input or option | Contract |
|---|---|
<CONSUMER> | Positional input; required or optional as shown in the invocation. |
--host <HOST> | Command option; required or optional as shown in the invocation. |
--capabilities <CAPABILITIES> | Command option; required or optional as shown in the invocation. |
--audience <AUDIENCE> | Command option; required or optional as shown in the invocation. |
--ttl-seconds <TTL_SECONDS> | Lifetime of the grant in seconds; without it the grant lives until `skarbiec grant revoke` withdraws it |
--replace-capabilities | Command option; required or optional as shown in the invocation. |
--token-item <TOKEN_ITEM> | Command option; required or optional as shown in the invocation. |
--token-field <TOKEN_FIELD> | Command option; required or optional as shown in the invocation. |
--raw-token | Command option; required or optional as shown in the invocation. |
--token-file-name <TOKEN_FILE_NAME> | With --token-item, the item's own value is written here on the vault owner, so the consumer's file and the registered bearer agree |
--store-item <STORE_ITEM> | Store a fresh bearer as the `token` field of this owner-vault item (kind `token`) when the item is absent, then register the item's value; a repeated run registers the same stored bearer |
--json | Command option; required or optional as shown in the invocation. |
Output and state effect
It performs the operation described above and emits its operator result on standard output or standard error. Any state change is limited to the resources and records named by the purpose and options on this page.
Refusals
- Before dispatch, Stado refuses a missing required token shown in the invocation, an unknown option, or a value outside a listed value set; argument-usage failures exit with code 2.