---
title: "subako api-key"
description: "API keys: the machine credentials a workspace's work runs under"
---

[CLI reference](/cli)

## `subako api-key`

API keys: the machine credentials a workspace's work runs under

### Usage

```text
Usage: subako api-key <COMMAND>
```

### Subcommands

- [`subako api-key mint`](#subako-api-key-mint)
- [`subako api-key list`](#subako-api-key-list)
- [`subako api-key permissions`](#subako-api-key-permissions)
- [`subako api-key revoke`](#subako-api-key-revoke)

### Options

#### `--help`

Print help

- Short option: `-h`.

## `subako api-key mint`

Mint a key in the selected workspace. Its secret is printed once

### Usage

```text
Usage: subako api-key mint [OPTIONS] --label <LABEL>
```

### Options

#### `--label <LABEL>`

Label describing what the key is for

- Required.

#### `--permission <PERMISSION>`

Permission to grant, repeated for each one, as `api-key permissions` lists them. The server owns the vocabulary and refuses a spelling it does not grant to a key.

Required unless --all-permissions is supplied. The two options cannot be combined.

- May be repeated to supply multiple values.
- Cannot be combined with: `--all-permissions`.

#### `--all-permissions`

Grant every permission this server allows a key to hold. The set is read from the server and recorded at mint time, so a permission added to it later is not granted to this key

- Default: `false`.

#### `--expires-at <EXPIRES_AT>`

When the key stops working, RFC 3339 (e.g. 2027-01-01T00:00:00Z). It never expires on its own when absent


#### `--profile <PROFILE>`

Credential profile to act as. Defaults to the current one


#### `--credentials-file <CREDENTIALS_FILE>`

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.


#### `--help`

Print help (see a summary with '-h')

- Short option: `-h`.

## `subako api-key list`

List the selected workspace's keys, revoked ones included

### Usage

```text
Usage: subako api-key list [OPTIONS]
```

### Options

#### `--profile <PROFILE>`

Credential profile to act as. Defaults to the current one


#### `--credentials-file <CREDENTIALS_FILE>`

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.


#### `--help`

Print help

- Short option: `-h`.

## `subako api-key permissions`

List the permissions this server grants a key

### Usage

```text
Usage: subako api-key permissions [OPTIONS]
```

### Options

#### `--profile <PROFILE>`

Credential profile to act as. Defaults to the current one


#### `--credentials-file <CREDENTIALS_FILE>`

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.


#### `--help`

Print help

- Short option: `-h`.

## `subako api-key revoke`

Revoke a key, so its secret stops authenticating

### Usage

```text
Usage: subako api-key revoke [OPTIONS] <API_KEY_ID>
```

### Arguments

#### `<API_KEY_ID>`

Key id, as `api-key list` shows it

- Required.

### Options

#### `--profile <PROFILE>`

Credential profile to act as. Defaults to the current one


#### `--credentials-file <CREDENTIALS_FILE>`

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.


#### `--help`

Print help

- Short option: `-h`.