Apikey Create

goodmem apikey create

Create a new API key

Synopsis

Create a new API key in the GoodMem service.

INHERIT_SUBJECT keys follow the subject principal's live authority. SCOPED keys further restrict that authority to the repeatable --ceiling rules supplied at issuance. A scoped issuing key may create only scoped children whose ceiling does not exceed either the subject's live authority or the issuing key's effective authority.

goodmem apikey create [flags]

Examples

  # Create a new API key with a client-provided ID
  goodmem apikey create --id "123e4567-e89b-12d3-a456-426614174000" --label env=dev

  # Explicitly inherit the current principal's live authority
  goodmem apikey create --authority-mode inherit-subject --label env=prod

  # Issue a scoped key for a service identity
  goodmem apikey create \
    --subject 70e025f6-76ca-4cbe-b8fc-7dab8e84590a \
    --authority-mode scoped \
    --ceiling READ_SPACE:EXACT:SPACE:550e8400-e29b-41d4-a716-446655440000 \
    --ceiling READ_MEMORY:DIRECT_MEMBERS_OF:SPACE:550e8400-e29b-41d4-a716-446655440000

Options

      --authority-mode string   Authority mode: inherit-subject or scoped (defaults to inherit-subject)
      --ceiling strings         Ceiling OPERATION:SELECTOR[:RESOURCE_KIND:RESOURCE_UUID] (repeatable)
      --expires-at string       Exclusive expiration time in RFC3339 format
  -h, --help                    help for create
      --id string               Optional: Client-provided UUID for the API key (16 bytes). Server generates if omitted.
  -l, --label strings           Label key=value (repeatable)
      --subject string          Principal UUID authenticated by the key (defaults to the current principal)
      --valid-from string       Inclusive activation time in RFC3339 format

Options inherited from parent commands

      --api-key string   API key for authentication (can also be set via GOODMEM_API_KEY environment variable)
  -f, --format string    Output format: table, json, or simple (default "table")
      --server string    GoodMem server address (gRPC API)