CLI Reference - Encryption Keys
Encryption Keys
create-key
create-key
Creates a new key - Deprecated: Use command create-dfc-key
Please note: mandatory values for this command: -n, --name
, -a, --alg
Usage
akeyless create-key --name <Key name> \
--alg <Key type> \
--delete-protection <Protection from accidental deletion of this item, [true/false]> \
--description <Key description> \
--split-level <The number of fragments that the item will be split into (Deafult = 2> \
--delete-protection <Protection from accidental deletion of this item, [true/false]>
Parameters
Parameter | Description |
---|---|
-n, --name | (Mandatory) Key name/path. |
-a, --alg | (Mandatory) Key type [AES128GCM, AES256GCM, AES128SIV, AES256SIV, AES128CBC, AES256CBC, RSA1024, RSA2048, RSA3072, RSA4096] |
--description | Key description |
-t, --tag | List of the tags attached to this key. To specify multiple tags use argument multiple times: -t Tag1 -t Tag2 |
-s, --split-level[=2] | The number of fragments that the item will be split into (not includes customer fragment) |
-f, --customer-frg-id | The customer fragment ID that will be used to create the key (if empty, the key will be created independently of a customer fragment) |
--delete-protection | Protection from accidental deletion of this item, [true/false] |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
create-classic-key
create-classic-key
Creates a new Classic Key
Please note: mandatory values for this command: -n, --name
, -a, --alg
Usage
akeyless create-classic-key --name <Key Name> \
--alg <Key type> \
--gateway-url <API Gateway URL:8000> \
--key-file-path <Path to file with the classic key value provided by user> \
--key-data <Base64-encoded classic key value provided by user> \
--cert <Path to a file that contain the certificate in a PEM format> \
--cert-file-data <PEM Certificate in a Base64 format> \
--delete-protection <Protection from accidental deletion of this item, [true/false]>
Parameters
Parameter | Description |
---|---|
-n, --name | (Mandatory) Classic key name/path. |
-a, --alg | (Mandatory) Key type; options: [AES128GCM, AES256GCM, AES128SIV, AES256SIV, RSA1024, RSA2048, RSA3072, RSA4096, EC256, EC384, GPG] |
--gpg-alg | Relevant only if GPG key type selected; options: [RSA1024, RSA2048, RSA3072, RSA4096, Ed25519] |
-u, --gateway-url[=http://localhost:8000] | API Gateway URL (Configuration Management port) |
-p, --key-file-path | Path to file with the classic key value provided by user |
--key-data | Base64-encoded classic key value provided by user |
-c, --cert | Path to a file that contain the certificate in a PEM format. |
--cert-file-data | PEM Certificate in a Base64 format. |
--description | Classic key description |
--generate-self-signed-certificate[=false] | Whether to generate a self signed certificate with the key. If set, --certificate-ttl must be provided. |
--certificate-ttl | TTL in days for the generated certificate. Required only for generate-self-signed-certificate. |
--certificate-common-name | Common name for the generated certificate. Relevant only for generate-self-signed-certificate. |
--certificate-organization | Organization name for the generated certificate. Relevant only for generate-self-signed-certificate. |
--certificate-country | Country name for the generated certificate. Relevant only for generate-self-signed-certificate. |
--certificate-locality | Locality for the generated certificate. Relevant only for generate-self-signed-certificate. |
--certificate-province | Province name for the generated certificate. Relevant only for generate-self-signed-certificate. |
-t, --tag | List of the tags attached to this secret. To specify multiple tags use argument multiple times: -t Tag1 -t Tag2 |
-k, --protection-key-name | The name of the key that protects the classic key value (if empty, the account default key will be used) |
--delete-protection | Protection from accidental deletion of this item, [true/false] |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
export-classic-key
export-classic-key
Returns the Classic Key material
Please note: mandatory values for this command: -n, --name
Usage
akeyless export-classic-key --name <Key name> \
--gateway-url <API Gateway URL:8000> \
Parameters
Parameter | Describrion |
---|---|
-n, --name | (Mandatory) Classic key name |
-v, --version | Classic key version |
--export-public-key[=false] | Export only the public key |
-u, --gateway-url[=http://localhost:8000] | API Gateway URL (Configuration Management port) |
--ignore-cache[=false] | Retrieve the Secret value without checking the Gateway's cache. This flag is only relevant when using the RestAPI |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
create-dfc-key
create-dfc-key
Creates a new DFC key
Please note: mandatory values for this command: -n, --name
, -a, --alg
Usage
akeyless create-dfc-key --name <Key name> \
--alg <Key type> \
--description <DFC key description> \
--split-level <The number of fragments that the item will be split into [Default = 2]> \
--delete-protection <Protection from accidental deletion of this item, [true/false]>
Parameters
Parameter | Description |
---|---|
-n, --name | (Mandatory) DFCKey name |
-a, --alg | (Mandatory) DFCKey type; options: [AES128GCM, AES256GCM, AES128SIV, AES256SIV, AES128CBC, AES256CBC, RSA1024, RSA2048, RSA3072, RSA4096] |
--description | DFC key description |
--generate-self-signed-certificate[=false] | Whether to generate a self signed certificate with the key. If set, --certificate-ttl must be provided. |
--certificate-ttl | TTL in days for the generated certificate. Required only for generate-self-signed-certificate. |
--certificate-common-name | Common name for the generated certificate. Relevant only for generate-self-signed-certificate. |
--certificate-organization | Organization name for the generated certificate. Relevant only for generate-self-signed-certificate. |
--certificate-country | Country name for the generated certificate. Relevant only for generate-self-signed-certificate. |
--certificate-locality | Locality for the generated certificate. Relevant only for generate-self-signed-certificate. |
--certificate-province | Province name for the generated certificate. Relevant only for generate-self-signed-certificate. |
-t, --tag | List of the tags attached to this DFC key. To specify multiple tags use the argument multiple times: -t Tag1 -t Tag2 |
-s, --split-level[=2] | The number of fragments that the item will be split into (not including customer fragment) |
-f, --customer-frg-id | The customer fragment ID that will be used to create the DFC key (if empty, the key will be created independently of a customer fragment) |
--delete-protection | Protection from accidental deletion of this item, [true/false] |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
rotate-key
rotate-key
Rotates an existing key, by creating a new version of the key.
Usage
akeyless rotate-key -n <Key name> \
--gateway-url <API Gateway URL:8000> \
--new-key-data <The new value of the key, base64 encoded>
Parameters
Parameter | Description |
---|---|
-n, --name | (Mandatory) Key name |
-u, --gateway-url[=http://localhost:8000] | API Gateway URL (Configuration Management port). Relevant only for Classic Key. |
--new-key-data | The new value of the key, base64 encoded. Relevant only for Classic Key provided by the user (BYOK). |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
refresh-key
refresh-key
Refresh a key
Please note: mandatory values for this command: -n, --name
Usage
akeyless refresh-key --name <Key name>
Parameters
Parameter | Description |
---|---|
-n, --name | (Mandatory) Key name |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
assoc-target-item
assoc-target-item
Create an association between a Target and a Classic Key for External KMS Integration
Please note: mandatory values for this command: -t, --target-name
, -n, --name
Usage
akeyless assoc-target-item --target-name <The target to associate> \
--name <The item to associate> \
--vault-name <Name of the vault used> \
--key-operations <A list of allowed operations for the key>
--project-id <Project id of the GCP KMS> \
--location-id <Location id of the GCP KMS> \
--keyring-name <Keyring name of the GCP KMS> \
--purpose <Purpose if the key in GCP KMS>
Parameters
Parameter | Description |
---|---|
-t, --target-name | (Mandatory) The target to associate |
-n, --name | (Mandatory) The item to associate |
--vault-name | Name of the vault used. (Relevant only for Classic Key and target association. Required for azure targets) |
--key-operations | A list of allowed operations for the key. (Relevant only for Classic Key and target association. Required for azure targets) |
--project-id | Project id of the GCP KMS. (Relevant only for Classic Key and target association. Required for gcp targets) |
--location-id | Location id of the GCP KMS. (Relevant only for Classic Key and target association. Required for gcp targets) |
--keyring-name | Keyring name of the GCP KMS. (Relevant only for Classic Key and target association. Required for gcp targets) |
--purpose | Purpose if the key in GCP KMS. (Relevant only for Classic Key and target association. Required for gcp targets) |
--kms-algorithm | Algorithm of the key in GCP KMS. (Relevant only for Classic Key and target association, Required for gcp targets) |
--tenant-secret-type | Set to 'true' to create a multi-region managed key. (Relevant only for Classic Key AWS targets) |
--multi-region[=false] | The list of regions in which to create a copy of the key. (Relevant only for Classic Key AWS targets). To specify multiple regions use argument multiple times: --regions us-east-1 --regions us-west-1 |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
get-rsa-public
get-rsa-public
Obtain the public key from a specific RSA private key
Please note: mandatory values for this command: -n, --name
Usage
akeyless get-rsa-public --name <RSA_private_Key_name>
Parameters
Parameter | Description |
---|---|
-n, --name | (Mandatory) Name of RSA key to extract the public key from |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
upload-pkcs12
upload-pkcs12
Upload a PKCS#12 key and certificates
Please note: mandatory values for this command: -n, --name
, -i, --in
, -p, --passphrase
Usage
akeyless upload-pkcs12 --name <Key name> \
--in <PKCS#12 input file (private key and certificate only> \
--passphrase <Passphrase to unlock the pkcs#12 bundle> \
--description <Key description> \
--customer-frg-id <Customer fragment ID that will be used to split the key) \
--cert <Path to a file that contain the certificate in a PEM format> \
--delete-protection <Protection from accidental deletion of this item, [true/false]>
Parameters
Parameter | Description |
---|---|
-n, --name | (Mandatory) Name of key to be created |
-i, --in | (Mandatory) PKCS#12 input file (private key and certificate only) |
-p, --passphrase | (Mandatory) Passphrase to unlock the pkcs#12 bundle |
--description | Key description |
-t, --tag | List of the tags attached to this key. To specify multiple tags use argument multiple times: -t Tag1 -t Tag2 |
-s, --split-level[=2] | The number of fragments that the item will be split into |
-f, --customer-frg-id | The customer fragment ID that will be used to split the key (if empty, the key will be created independently of a customer fragment) |
-c, --cert | Path to a file that contain the certificate in a PEM format. If this parameter is not empty, the certificate will be taken from here and not from the PKCS#12 input file |
--delete-protection[=false] | Protection from accidental deletion of this item, [true/false] |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
upload-rsa
upload-rsa
Upload RSA key
Please note: mandatory values for this command: -n, --name
, -a, --alg
Usage
akeyless upload-rsa --name <Name of key to be created> \
--alg <Key type> \
--rsa-key-file-path <RSA private key file path> \
--rsa-key-data <RSA private key data, base64 encoded> \
--cert <Path to a file that contain the certificate in a PEM format> \
--cert-file-data <PEM Certificate in a Base64 format>
Parameters
Parameter | Description |
---|---|
-n, --name | (Mandatory) Name of key to be created |
-a, --alg | (Mandatory) Key type. options: [RSA1024, RSA2048, RSA3072, RSA4096] |
-p, --rsa-key-file-path | RSA private key file path. |
--rsa-key-data | RSA private key data, base64 encoded |
-c, --cert | Path to a file that contain the certificate in a PEM format |
--cert-file-data | PEM Certificate in a Base64 format |
--description | Key description |
-t, --tag | List of the tags attached to this key. To specify multiple tags use argument multiple times: -t Tag1 -t Tag2 |
-s, --split-level[=2] | The number of fragments that the item will be split into |
-f, --customer-frg-id | The customer fragment ID that will be used to split the key (if empty, the key will be created independently of a customer fragment) |
--overwrite[=false] | When the overwrite flag is set, this command will only update an existing key. [true, false] |
--delete-protection | Protection from accidental deletion of this item, [true/false] |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
update-rotation-settings
update-rotation-settings
Updates rotation settings of an existing key.
Please note: mandatory values for this command: -n, --name
, -r, --auto-rotate
Usage
akeyless update-rotation-settings --name <Key name> \
--auto-rotate=<True/False> \
--rotation-interval <The number of days to wait between every automatic key rotation (7-365)>
Parameters
Parameter | Description |
---|---|
-n, --name | (Mandatory) Key name |
-r, --auto-rotate[=false] | (Mandatory) [true/false] Sets automatic rotation to be enabled or disabled, if enabled rotation will be triggered periodically based on --rotation-interval |
--rotation-interval | The number of days to wait between every automatic key rotation (7-365) |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
encrypt
encrypt
Encrypts plaintext into ciphertext by using an AES key
Usage
akeyless encrypt -k <Key name> \
--display-id <Display id of the key to use in the encryption process \
--item-id <Item id of the key to use in the encryption process> \
--in <Path to the file to be encrypted in base64 format> \
Parameters
Parameter | Description |
---|---|
-k, --key-name | The name of the key to use in the encryption process |
-d, --display-id | The display id of the key to use in the encryption process |
-I, --item-id | The item id of the key to use in the encryption process |
-i, --in | Path to the file to be encrypted in base64 format |
-o, --out | Path to the output file. If not provided, the output will be printed as base64 |
-p, --plaintext | Data to be encrypted, if a file was not provided |
-X, --encryption-context | name-value pair that specifies the encryption context to be used for authenticated encryption. If used here, the same value must be supplied to the decrypt command or decryption will fail |
-F, --input-format | If specified, the plaintext input is assumed to be formatted accordingly. Current supported options: [base64] |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
encrypt-file
encrypt-file
Encrypts a file by using an AES key
Usage
akeyless encrypt-file --key-name <Key Name> \
--in <Path/to/file> \
--display-id <Display id of the key to use in the encryption process> \
--item-id <The item id of the key to use in the encryption process>
Parameters
Parameter | Description |
---|---|
-k, --key-name | The name of the key to use in the encryption process |
-d, --display-id | The display id of the key to use in the encryption process |
-I, --item-id | The item id of the key to use in the encryption process |
-i, --in | (Mandatory) Path to the file to be encrypted. If not provided, the content will be taken from stdin |
-o, --out | Path to the output file. If not provided, the output will be sent to stdout |
-F, --output-format[=base64] | The output will be formatted accordingly. options: [base64, raw] |
-X, --encryption-context | name-value pair that specifies the encryption context to be used for authenticated encryption. If used here, the same value must be supplied to the decrypt command or decryption will fail |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
encrypt-pkcs1
encrypt-pkcs1
Encrypts the given message with RSA and the padding scheme from PKCS#1 v1.5
Please note: mandatory values for this command: -p, --plaintext
Usage
akeyless encrypt-pkcs1 -k <key Name> \
--plaintext <Data to encrypt> \
--display-id <Display id of the key to use in the encryption process> \
--item-id <Item id of the key to use in the encryption process>
Parameters
Parameter | Description |
---|---|
-k, --key-name | The name of the key to use in the encryption process |
-d, --display-id | The display id of the key to use in the encryption process |
-I, --item-id | The item id of the key to use in the encryption process |
-p, --plaintext | (Mandatory) Data to be encrypted |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
encrypt GPG
encrypt GPG
Encrypts the given message with GPG using an RSA key
Usage
akeyless encrypt-gpg -k <Key name> \
--display-id <Display id of the key to use in the encryption process \
--item-id <Item id of the key to use in the encryption process> \
--in <Path to the file to be encrypted in base64 format> \
Parameters
Parameter | Description |
---|---|
-k, --key-name | The name of the key to use in the encryption process |
-d, --display-id | The display id of the key to use in the encryption process |
-I, --item-id | The item id of the key to use in the encryption process |
-i, --in | Path to the file to be encrypted in base64 format |
-o, --out | Path to the output file. If not provided, the output will be printed as base64 |
-p, --plaintext | Data to be encrypted, if a file was not provided |
-F, --input-format | If specified, the plaintext input is assumed to be formatted accordingly. Current supported options: [base64] |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
-h, --help | Display help information |
--json[=false] | Set output format to JSON |
--jq-expression | JQ expression to filter result output |
--no-creds-cleanup[=false] | Do not clean local temporary expired creds |
decrypt
decrypt
Decrypts ciphertext into plaintext by using an AES key
Usage
akeyless decrypt --key-name <Key Name> \
--ciphertext <Ciphertext to be decrypt in base64 encoded format> \
--display-id <Display id of the key to use in the encryption process> \
--item-id <Item id of the key to use in the encryption process>
Parameters
Parameter | Description |
---|---|
-k, --key-name | The name of the key to use in the decryption process. |
-d, --display-id | The display id of the key to use in the decryption process |
-I, --item-id | The item id of the key to use in the decryption process |
-i, --in | Path to the file to be decrypted (base64 encoded) |
-o, --out | Path to the output file. If not provided, the output will be printed as text. |
-c, --ciphertext | Ciphertext to be decrypted in base64 encoded format, if a file was not provided |
-X, --encryption-context | The encryption context. If this was specified in the encrypt command, it must be specified here or the decryption operation will fail |
-F, --output-format | If specified, the output will be formatted accordingly. options: [base64] |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
decrypt-file
decrypt-file
Decrypts a file by using an AES key
Please note: mandatory values for this command: -i, --in
Usage
akeyless decrypt-file --key-name <key name> \
--in <file to decrypt> \
--display-id <Display id of the key to use in the decryption process> \
--item-id <Item id of the key to use in the encryption process>
Parameters
Parameter | Description |
---|---|
--key-name | The name of the key to use in the decryption process |
-d, --display-id | The display id of the key to use in the decryption process |
-I, --item-id | The item id of the key to use in the decryption process |
-i, --in | (Mandatory) Path to the file to be decrypted. If not provided, the content will be taken from stdin |
-o, --out | Path to the output file. If not provided, the output will be sent to stdout |
-F, --output-format[=base64] | The output will be formatted accordingly. options: [base64, raw] |
-X, --encryption-context | The encryption context. If this was specified in the encrypt command, it must be specified here or the decryption operation will fail |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
decrypt-pkcs1
decrypt-pkcs1
Decrypts a plaintext using RSA and the padding scheme from PKCS#1 v1.5
Please note: mandatory values for this command: -c, --ciphertext
Usage
akeyless decrypt-pkcs1 --key-name <RSA Key Name> \
--ciphertext <Ciphertxt to decrypt> \
--display-id <Display id of the key to use in the decryption process> \
--item-id <Item id of the key to use in the encryption process>
Parameters
Parameter | Description |
---|---|
-k, --key-name | The name of the key to use in the decryption process |
-d, --display-id | The display id of the key to use in the decryption process |
-I, --item-id | The item id of the key to use in the decryption process |
-c, --ciphertext | (Mandatory) Ciphertext to be decrypted in base64 encoded format |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
decrypt GPG
decrypt GPG
Decrypts ciphertext into plaintext by using an AES key
Usage
akeyless decrypt-gpg --key-name <Key Name> \
--ciphertext <Ciphertext to be decrypt in base64 encoded format> \
--display-id <Display id of the key to use in the encryption process> \
--item-id <Item id of the key to use in the encryption process>
Parameters
Parameter | Description |
---|---|
-k, --key-name | The name of the key to use in the decryption process. |
-d, --display-id | The display id of the key to use in the decryption process |
-I, --item-id | The item id of the key to use in the decryption process |
-i, --in | Path to the file to be decrypted (base64 encoded) |
-o, --out | Path to the output file. If not provided, the output will be printed as text. |
-c, --ciphertext | Ciphertext to be decrypted in base64 encoded format, if a file was not provided |
-p, --passphrase | Passphrase to decrypt the message |
-F, --output-format | If specified, the output will be formatted accordingly. options: [base64] |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
-h, --help | Display help information |
--json[=false] | Set output format to JSON |
--jq-expression | JQ expression to filter result output |
--no-creds-cleanup[=false] | Do not clean local temporary expired creds |
sign-pkcs1
sign-pkcs1
Calculates the signature of hashed using RSASSA-PKCS1-V1_5-SIGN from RSA PKCS#1 v1.5
Please note: mandatory values for this command: -m, --message
Usage
akeyless sign-pkcs1 --key-name <RSA signing key name> \
--message <Message to sign> \
--display-id <Display id of the key to use in the decryption process> \
--item-id <Item id of the key to use in the encryption process>
Parameters
Parameter | Description |
---|---|
-k, --key-name | The name of the RSA key to use in the signing process |
-d, --display-id | The display id of the key to use in the signing process |
-I, --item-id | The item id of the key to use in the signing process |
-m, --message | (Mandatory) The message to be signed |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
verify-pkcs1
verify-pkcs1
Verifies an RSA PKCS#1 v1.5 signature
Please note: mandatory values for this command: -m, --message
, -s, --signature
Usage
akeyless verify-pkcs1 --key-name <RSA Key> \
--message <message to verify> \
--signature <message signature> \
--display-id <Display id of the key to use in the decryption process> \
--item-id <Item id of the key to use in the encryption process>
Parameters
Parameter | Description |
---|---|
-k, --key-name | The name of the RSA key to use in the verification process |
-d, --display-id | The display id of the key to use in the verification process |
-I, --item-id | The item id of the key to use in the verification process |
-m, --message | (Mandatory) The message to be verified. |
-s, --signature | (Mandatory) The message's signature. |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
sign GPG
sign GPG
Calculates the signature of a message using GPG from an RSA key
Please note: mandatory values for this command: -m, --message
Usage
akeyless sign-gpg --key-name <RSA signing key name> \
--message <Message to sign> \
--display-id <Display id of the key to use in the decryption process> \
--item-id <Item id of the key to use in the encryption process>
Parameters
Parameter | Description |
---|---|
-k, --key-name | The name of the RSA key to use in the signing process |
-d, --display-id | The display id of the key to use in the signing process |
-I, --item-id | The item id of the key to use in the signing process |
-m, --message | (Mandatory) The message to be signed |
-p, --passphrase | Passphrase to decrypt the message |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
-h, --help | Display help information |
--json[=false] | Set output format to JSON |
--jq-expression | JQ expression to filter result output |
--no-creds-cleanup[=false] | Do not clean local temporary expired creds |
verify GPG
verify GPG
Verifies a GPG based on RSA signature
Please note: mandatory values for this command: -m, --message
, -s, --signature
Usage
akeyless verify-gpg --key-name <RSA Key> \
--message <message to verify> \
--signature <message signature> \
--display-id <Display id of the key to use in the decryption process> \
--item-id <Item id of the key to use in the encryption process>
Parameters
Parameter | Description |
---|---|
-k, --key-name | The name of the RSA key to use in the verification process |
-d, --display-id | The display id of the key to use in the verification process |
-I, --item-id | The item id of the key to use in the verification process |
-m, --message | (Mandatory) The message to be verified. |
-s, --signature | (Mandatory) The message's signature. |
-p, --passphrase | Passphrase to decrypt the message |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
-h, --help | Display help information |
--json[=false] | Set output format to JSON |
--jq-expression | JQ expression to filter result output |
--no-creds-cleanup[=false] | Do not clean local temporary expired creds |
hmac
hmac
Generates a hash-based message authentication code (HMAC) for a message, using an HMAC algorithm
Usage
akeyless hmac -p <plaintext> -f <hash function>
Parameters
Parameter | Description |
---|---|
-k, --key-name | The name of the key to use in the encryption process |
-d, --display-id | The display id of the key to use in the encryption process |
-I, --item-id | The item id of the key to use in the encryption process |
-i, --in | Path to the input file |
-o, --out | Path to the output file. If not provided, the output will be printed as base64 |
-p, --plaintext | Data to perform hmac on, if a file was not provided |
-f, --hash-function[=sha-256] | Hash function [sha-256,sha-512] |
-F, --input-format | Select the default assumed format for any plaintext input. Currently supported options: [base64] |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
-h, --help | Display help information |
--json[=false] | Set output format to JSON |
--jq-expression | JQ expression to filter result output |
--no-creds-cleanup[=false] | Do not clean local temporary expired creds |
gen-customer-fragment
gen-customer-fragment
Generates Customer Fragment
Usage
akeyless gen-customer-fragment --description <Customer Fragment Description>
gateway-download-customer-fragments
gateway-download-customer-fragments
Download gateway customer fragments
Usage
akeyless gateway-download-customer-fragments -f <path to download to> -u <gateway URL>
set-item-state
set-item-state
Set an item's state (Enabled, Disabled)
Please note: mandatory values for this command: -n, --name
, -s, --desired-state
Usage
akeyless set-item-state --name <Item name> \
--desired-state <Desired state>
Parameters
Parameter | Description |
---|---|
-n, --name | (Mandatory) Current item name. |
-s, --desired-state | (Mandatory) Desired item state [Enabled, Disabled] |
--version[=0] | The specific version you want to update: 0=item level state (default) |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
Tokenization
create-tokenizer
create-tokenizer
Creates a new tokenizer.
Please note: mandatory values for this command: -n, --name
, -y, --tokenizer-type[=vaultless]
, -T, --template-type
Usage
akeyless create-tokenizer \
--name <Tokenizer name> \
--tokenizer-type <vaultless> \
--template-type <SSN, CreditCard, USPhoneNumber> \
--tweak-type <Supplied, Generated, Internal, Masking>
akeyless create-tokenizer \
--name <Tokenizer name> \
--tokenizer-type <vaultless> \
--template-type <Custom> \
--tweak-type <Supplied, Generated, Internal, Masking> \
--alphabet <Symbols to use for tokenization> \
--pattern <A regexp pattern to extract tokenized parts> \
--encoding-template <An expression to alter the template of the encryption output> \
--decoding-template <An expression to alter the template of the decryption output>
Parameters
Parameter | Description |
---|---|
-n, --name | (Mandatory) Tokenizer name |
-y, --tokenizer-type[=vaultless] | (Mandatory) Tokenizer type(vaultless) |
-T, --template-type | (Mandatory) Which template type this tokenizer is used for [SSN,CreditCard,USPhoneNumber,Custom] |
--encryption-key-name | AES key name to use in vaultless tokenization |
--tweak-type | The tweak type to use in vaultless tokenization [Supplied, Generated, Internal, Masking] |
--alphabet | Alphabet to use in custom vaultless tokenization, such as '0123456789' for credit cards. |
--pattern | Pattern to use in custom vaultless tokenization |
--encoding-template | The Encoding output template to use in custom vaultless tokenization |
--decoding-template | The Decoding output template to use in custom vaultless tokenization |
--description | Tokenizer description |
--tag | List of the tags attached to this key. To specify multiple tags use argument multiple times: --tag Tag1 --tag Tag2 |
--delete-protection | Protection from accidental deletion of this item, [true/false] |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
tokenize
tokenize
Encrypts text with a tokenizer.
Please note: mandatory values for this command: -n, --tokenizer-name
, -p, --plaintext
Usage
akeyless tokenize \
--tokenizer-name <Tokenizer name> \
--plaintext <Data to be encrypted> \
--tweak <Base64-encoded tweak value
Parameters
Parameter | Description |
---|---|
-n, --tokenizer-name | (Mandatory) The name of the tokenizer to use in the encryption process |
-p, --plaintext | (Mandatory) Data to be encrypted |
--tweak | Base64 encoded tweak for vaultless encryption |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
detokenize
detokenize
Decrypts text with a tokenizer
Please note: mandatory values for this command: -n, --tokenizer-name
, -c, --ciphertext
Usage
akeyless detokenize \
--tokenizer-name <Tokenizer name> \
--ciphertext <Data to be decrypted> \
--tweak <Base64-encoded tweak value that was used for encryption>
Parameters
Parameter | Description |
---|---|
-n, --tokenizer-name | (Mandatory) The name of the tokenizer to use in the decryption process |
-c, --ciphertext | (Mandatory) Data to be decrypted |
--tweak | Base64 encoded tweak for vaultless encryption |
--profile, --token | Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token |
--uid-token | The universal identity token, Required only for universal_identity authentication |
Updated 7 days ago