CLI Reference

Creddy command-line interface.

Global Flags

Flag	Description
`--config`	Path to config file
`--server`	Server URL
`-v, --verbose`	Verbose output

Client Commands

`creddy init`

Initialize the client and enroll with a server.


creddy init [flags]

Flag	Default	Description
`--name`	hostname	Client name
`--server`		Server URL (required)
`--admin-token`		Bootstrap admin token (first admin only)
`--timeout`	`5m`	Enrollment timeout

Examples


# Standard enrollment (requires admin approval)
creddy init --name my-laptop --server https://creddy.example.com
 
# Bootstrap first admin with token
creddy init --name admin-laptop --server https://creddy.example.com \
  --admin-token ctk_XXXXX

`creddy get`

Request a credential from a backend.


creddy get <backend> [flags]

Flag	Default	Description
`--ttl`	Backend default	Time to live
`--scope`		Scopes (repeatable)
`-o, --output`	`text`	Output format (text, json, env)

Examples


# Basic usage
creddy get github
 
# With TTL and scopes
creddy get github --ttl 30m --scope repo:read --scope issues:write
 
# Output as environment variables
creddy get aws --output env
export $(creddy get aws -o env)

`creddy backends`

List available backends.


creddy backends [flags]

Flag	Description
`-o, --output`	Output format (text, json)

`creddy rotate-key`

Rotate the client’s keypair.


creddy rotate-key [flags]

Flag	Default	Description
`--grace-period`	`24h`	How long to accept old key

`creddy status`

Show client status and server connection.


creddy status

Example Output


Client: my-laptop (cli_xyz789)
Server: https://creddy.example.com
Status: connected
Role:   operator

Fingerprint: SHA256:xK3E8f...
Last sync:   2024-01-15 16:30:00

Admin Commands

`creddy admin enrollments`

List pending enrollment requests.


creddy admin enrollments [flags]

Flag	Description
`--status`	Filter by status (pending, approved, denied)
`-o, --output`	Output format (text, json)

Example Output


ID            NAME        USER    HOST              IP              EXPIRES
enr_abc123    my-laptop   marc    marcbook.local    192.168.1.50    4:32
enr_def456    ci-runner   root    ci-node-01        10.0.0.50       2:15

`creddy admin approve`

Approve an enrollment request.


creddy admin approve <enrollment_id> [flags]

Flag	Default	Description
`--role`	`operator`	Client role (operator, admin)
`--note`		Admin note

Example


creddy admin approve enr_abc123 --role admin --note "Marc's laptop"

`creddy admin deny`

Deny an enrollment request.


creddy admin deny <enrollment_id> [flags]

Flag	Description
`--reason`	Reason for denial

`creddy admin clients`

List registered clients.


creddy admin clients [flags]

Flag	Description
`--status`	Filter by status (active, revoked)
`-o, --output`	Output format (text, json)

Example Output


ID            NAME        ROLE      LAST SEEN           STATUS
cli_xyz789    my-laptop   admin     2024-01-15 16:30    active
cli_abc123    ci-runner   operator  2024-01-15 14:00    active

`creddy admin revoke`

Revoke a client’s access.


creddy admin revoke <client_id> [flags]

Flag	Description
`--reason`	Reason for revocation

Server Commands

`creddy server`

Start the Creddy server.


creddy server [flags]

Flag	Default	Description
`--port`	`8080`	Server port
`--host`	`0.0.0.0`	Host to bind
`--data-dir`	`~/.creddy`	Data directory

`creddy backend add`

Add a backend to the server.


creddy backend add <name> --type <type> [flags]

Flag	Description
`--type`	Backend type (github, aws, generic)
`--config`	Path to config file

Example


creddy backend add github --type github \
  --app-id 12345 \
  --private-key ./github-app.pem

`creddy keys`

Manage server signing keys.


creddy keys <subcommand>

Subcommands

creddy keys list — List all signing keys
creddy keys rotate — Generate a new signing key
creddy keys revoke <key-id> — Revoke a signing key
creddy keys export <key-id> — Export public key

`creddy audit`

Query the audit log.


creddy audit [flags]

Flag	Default	Description
`--backend`		Filter by backend
`--client`		Filter by client
`--since`	`24h`	Start time
`--until`		End time
`--limit`	`100`	Max results
`-o, --output`	`text`	Output format

Environment Variables

Variable	Description
`CREDDY_SERVER`	Server URL
`CREDDY_CONFIG`	Config file path
`CREDDY_DATA_DIR`	Data directory

Exit Codes

Code	Description
`0`	Success
`1`	General error
`2`	Invalid arguments
`3`	Connection error
`4`	Authentication error
`5`	Enrollment denied/expired

CLI Reference — Additions

These commands should be added to the existing CLI reference.

Agent Commands

`creddy agent create`

Create a new agent identity (server-side).


creddy agent create <name> [flags]

Flag	Description
`--can`	Scopes this agent can request (repeatable)

Examples


# Create CI agent with read-only access
creddy agent create ci-runner --can github:myorg/*:read
 
# Create agent with multiple scopes
creddy agent create dev-laptop --can github:* --can anthropic:*

`creddy agent ls`

List registered agents.


creddy agent ls

`creddy request`

Request additional permissions for the current agent.


creddy request [flags]

Flag	Description
`--can`	Permission to request (repeatable)

Examples


creddy request --can github:myorg/new-repo
creddy request --can github:myorg/repo:write

`creddy unenroll`

Remove an enrolled agent (admin command).


creddy unenroll <client_id>

Plugin Commands

`creddy plugin ls`

List installed and available plugins.


creddy plugin ls [flags]

Flag	Description
`--installed`	Show only installed plugins

`creddy plugin install`

Install plugins from the registry, OCI registry, or URL.


creddy plugin install <plugin[@version]> [plugin...] [flags]

Examples


creddy plugin install github
creddy plugin install github@0.2.0
creddy plugin install github anthropic doppler
creddy plugin install https://example.com/plugin.tar.gz
creddy plugin install ttl.sh/creddy-github:1h

`creddy plugin upgrade`

Upgrade installed plugins.


creddy plugin upgrade [plugin...] [flags]

Flag	Description
`--all`	Upgrade all installed plugins

Examples


creddy plugin upgrade github
creddy plugin upgrade --all

`creddy plugin outdated`

Show plugins with available updates.


creddy plugin outdated

`creddy plugin info`

Show detailed plugin information.


creddy plugin info <plugin>

`creddy plugin rm`

Remove an installed plugin.


creddy plugin rm <plugin>

Upgrade Commands

`creddy upgrade`

Upgrade Creddy to the latest version.


creddy upgrade

`creddy version`

Print version and check for updates.


creddy version [flags]

Flag	Description
`--json`	Machine-readable output

`creddy which`

Show paths and diagnostics for the Creddy installation.


creddy which

Shows binary location, config paths, plugin directories, and systemd service status.

Service Commands

`creddy install`

Install Creddy as a systemd service.


creddy install [flags]

Flag	Default	Description
`--listen`	`0.0.0.0:8400`	Address to listen on
`--data-dir`	`/var/lib/creddy`	Data directory
`--agent-inactivity-days`	`0`	Auto-unenroll inactive agents (0 = disabled)

`creddy uninstall`

Remove the Creddy systemd service.


creddy uninstall

Environment Variables

Variable	Description
`CREDDY_SERVER`	Server URL
`CREDDY_CONFIG`	Config file path
`CREDDY_DATA_DIR`	Data directory

Exit Codes

Code	Description
`0`	Success
`1`	General error
`2`	Invalid arguments
`3`	Connection error
`4`	Authentication error
`5`	Enrollment denied/expired