​

api-keys

orc api-keys creates API keys for the selected Workspace, inspects and updates metadata and permissions, and revokes unused keys. The one-time secret returned on creation is saved to a new private file; normal output contains only metadata.

Use the CLI identity obtained with orc auth login. Browser API session authentication is also supported, but an API key cannot manage keys. The CLI creates Workspace-scoped keys only.

List API key metadata.

Lists key metadata. Use --limit and --cursor for pagination. The response contains no secrets.

Creates a key using --name and a new destination in --output. --mode is live or test; --type is read_only or read_write. --scope organization and workspace_id: null are rejected before calling the API.

Retry identity for operations that support idempotency. Use a unique key for each new operation, and reuse it only when retrying the same HTTP method, path, query values and exact request body. JSON whitespace changes can count as a different body. Keys contain 1–255 characters after trimming and expire after 24 hours. A completed JSON response is replayed without repeating the operation. A different request using the same key returns 409 idempotency_error. An in-progress request returns 409 idempotency_in_progress with Retry-After: 2. Whether this header is required depends on the operation.

Type: string. Optional.

Key mode. live consumes credits, test uses sandbox.; enum: live|test

Type: string. Optional.

(required) Required human-readable name.

Type: string. Optional.

Credential binding scope. Organization scope creates a key without a Workspace binding.; enum: workspace|organization

Type: string. Optional.

Permission type. read_only grants read access; read_write grants read and write access.; enum: read_only|read_write

Type: string. Optional.

Optional explicit Workspace binding. Omit for the current Workspace; use null with organization scope.; (use "null" or "reset" to clear)

Type: string. Optional.

Updates --name, --type, or a JSON object in --permissions for the specified key ID. This does not retrieve the secret again.

New display name.

Type: string. Optional.

Endpoint-group permission map. Each key is an endpoint group name,
value is the access level. Unspecified groups default to none.; (JSON object, e.g. '{"custom_id":"x"}')

Type: string. Optional.

Permission preset for a user-owned key.; enum: read_only|read_write

Type: string. Optional.

Revokes the specified key ID. Revocation cannot be undone. Non-interactive execution requires --yes.

Create a key and save its secret to a new private file.

Rename a key.

Revoke an unused key.

Pass a file that does not exist to --output. The CLI saves it atomically with owner-only permissions (0600) and does not overwrite existing files. Prepare the parent directory and choose a location outside source control. Standard output contains metadata with the secret removed.

The following global options can be used with orc api-keys:

For details and examples, see global options.