cub user key add

cub user key add

Register a public key for an identity

Synopsis

Register a public key against an identity.

Either generate a keypair here with --generate, which stores the private key locally and registers the public half, or register a public key you already have with --public-key.

--generate takes an alias or a path. A bare name is an alias stored under ~/.confighub/keys, which is what "cub auth login --private-key=" looks up; anything containing a path separator is written there instead and has no alias.

The private key never reaches ConfigHub in either case. --generate creates it locally and only the public half is sent.

Examples:

  # Generate a keypair, storing it under ~/.confighub/keys as the alias "my-worker"
  cub user key add --worker my-worker --generate my-worker

  # ...then authenticate with it
  cub auth login --private-key=my-worker

  # Generate to an explicit path instead of an alias
  cub user key add --worker my-worker --generate ./my-worker.jwk

  # Register a public key you already have
  cub user key add --worker my-worker --public-key ./worker.pub.jwk

  # Register a public key from stdin, with a note about who holds it
  cat worker.pub.jwk | cub user key add --worker my-worker --public-key - \
      --description "CI runner, us-east"

cub user key add [flags]

Options

      --description string   note recording which host or pipeline holds the private key
      --dry-run              report what the command would write, and write nothing
      --generate string      generate an Ed25519 keypair, store the private key under this alias (or path), and register the public half
  -h, --help                 help for add
      --public-key string    file holding the public key as a JWK, or - for stdin

Options inherited from parent commands

      --component string   the Component of --variant, when that names the variant alone; --variant <component>/<variant> says the same in one flag
      --context string     The context to use for this command
      --debug              Debug output
      --space string       space to operate in, by slug or UUID. Omitted, a list or bulk operation spans the organization and a single entity is named as <space>/<slug>
      --user string        identity to manage keys for, by username or UUID
      --variant string     variant to operate in, as <component>/<variant>, or as <variant> with --component: the space naming that Component whose Variant label is <variant>. The same scope as --space, named by what it is rather than by the space's slug; the two cannot be combined
      --worker string      worker whose bot user to manage keys for, by slug or UUID

SEE ALSO

• cub user key - Manage the public keys registered against an identity