| name | keygen-cli |
| description | keygen-cli — manage keygen.sh from the command line: products, policies, licenses,
machines, releases, artifacts, webhooks, users, and tokens. Works against keygen.sh
Cloud, self-hosted CE, and self-hosted EE. Use this skill whenever the user mentions:
keygen.sh, license management, software licensing, license key, license activation,
activate machine, suspend license, revoke license, renew license, release artifact
upload, webhook endpoint, entitlement, policy, product token, offline license verify.
All write operations require explicit human approval — see references/permissions.md
for the three-tier rule set.
|
| version | 0.3.1 |
| license | MIT |
| homepage | https://github.com/okooo5km/keygen-cli |
| author | okooo5km |
| metadata | {"binary":"keygen","alias":"kg","requires":{"bins":["keygen"]},"install":[{"kind":"brew","formula":"okooo5km/tap/keygen-cli","bins":"[Truncated]"},{"kind":"cargo","crate_git":"https://github.com/okooo5km/keygen-cli"}],"references":{"installation":"./references/installation.md","commands":"./references/commands.md","permissions":"./references/permissions.md","envelope":"./references/ai-envelope.md","tui":"./references/tui.md","recipes":"./references/recipes.md"}} |
keygen-cli
A Rust CLI for keygen.sh. One binary, three deployments
(Cloud / self-hosted CE / self-hosted EE), and a stable JSON envelope built for
agents. Every command emits the same { ok, data, meta?, error? } shape under
--json, and exit codes are documented and stable.
Setup
brew install okooo5km/tap/keygen-cli
keygen --version
Other paths (pre-built tarballs, cargo install, source) live in
references/installation.md.
Authenticate
keygen login
keygen whoami
Tokens land in the OS keyring (Keychain on macOS, Secret Service on Linux,
Credential Manager on Windows). For CI and ephemeral shells, set
KEYGEN_TOKEN=... instead — that path skips the keyring entirely. Switch
deployments with --profile <name> or KEYGEN_PROFILE.
Core invocation pattern
Every resource exposes the same CRUD surface. Resource-specific actions
(validate, suspend, publish, ...) sit on the same subcommand tree.
keygen <resource> list [--filter k=v] [--limit N] [--page N] [--sort field]
keygen <resource> get <id>
keygen <resource> create [--from-file body.json | --set attrs.x=y --metadata k=v]
keygen <resource> update <id> [--from-file body.json | --set ...]
keygen <resource> delete <id> --yes
Two examples:
keygen license list --filter status=ACTIVE --json
keygen license create --json --policy pol_abc --user usr_def --set attrs.name="Acme"
--json (a gh-style shortcut for --output json) always emits the canonical
envelope. Exit codes: ok, user, server, network, auth,
capability. Full envelope schema in
.
