ak secrets recovery

Use ak secrets recovery for the operation described below. The command help records its arguments, effects, and options.

Command contract

Manage the file backend's vault and its recovery keys

Synopsis

The file backend keeps every secret in one age-encrypted vault opened with a passphrase. A recovery key is a second way in: an age keypair whose public half the vault is encrypted to, and whose private half you keep somewhere the host cannot reach. Without one, a forgotten passphrase means the vault is gone — there is no reset. These commands create the vault, add and remove recovery keys, and accept a vault that has moved backwards in time.

Examples

  ak secrets recovery init --label laptop-card   # create the vault and its first key
  ak secrets recovery list                       # labels and fingerprints, never keys
  ak secrets recovery add age1... --label backup-card
  ak secrets recovery remove <fingerprint>       # cut a lost key out of future writes

Options

  -h, --help             help for recovery
      --json             Emit machine-readable JSON (implies --no-interactive)
      --no-interactive   Disable interactive prompts (CI-safe)
  -q, --quiet            Suppress non-error output on stderr
  -V, --verbose          Extra diagnostic output on stderr (loses to --quiet)
  -y, --yes              Assume yes for all prompts

SEE ALSO

• ak secrets - Manage named secret values (API keys, tokens)
• ak secrets recovery accept-rollback - Accept a vault that is older than the last one this host saw
• ak secrets recovery add - Add another recovery recipient to the vault
• ak secrets recovery init - Create the vault and print its first recovery key once
• ak secrets recovery list - List the vault's recovery recipients
• ak secrets recovery remove - Remove a recovery recipient from the vault