ak secrets recovery add

Use ak secrets recovery add for the operation described below. The command help records its arguments, effects, and options.

Command contract

Add another recovery recipient to the vault

Synopsis

Add an age public key (age1...) to the vault's recipient set and re-encrypt the vault to it. The matching private key opens the vault from now on, so this is how a second recovery card, a colleague's key, or a key held on separate hardware is enrolled. Only the public half is ever given to AgentKit.

Effects: Opens the vault with the current passphrase, adds the recipient, and rewrites vault.age encrypted to the expanded set.

Exit status: 0 success 2 no key given, or it is not an age recipient 3 no vault at that path 4 that public key is already a recipient 5 the vault could not be rewritten

ak secrets recovery add [public-key] [flags]

Examples

  ak secrets recovery add age1abc... --label backup-card
  ak secrets recovery add --from-file ./colleague.pub --label alex

Options

      --from-file string   Read the age public key from this file instead of an argument
  -h, --help               help for add
      --json               Emit machine-readable JSON (implies --no-interactive)
      --label string       Label recorded for this recovery key (required)
      --no-interactive     Disable interactive prompts (CI-safe)
  -q, --quiet              Suppress non-error output on stderr
  -V, --verbose            Extra diagnostic output on stderr (loses to --quiet)
  -y, --yes                Assume yes for all prompts

SEE ALSO

• ak secrets recovery - Manage the file backend's vault and its recovery keys