ak secrets recovery remove

Use ak secrets recovery remove for the operation described below. The command help records its arguments, effects, and options.

Command contract

Remove a recovery recipient from the vault

Synopsis

Drop a recovery recipient by fingerprint and re-encrypt the vault without it. This cuts that key out of every future write. It does not reach a copy of the vault someone already kept: anything encrypted to the key before the removal stays readable with it forever, so treat a leaked key as a reason to rotate the secrets themselves. Fingerprints are matched in full, never by prefix. Removing the last recovery recipient is refused — it would leave the passphrase as the only way in.

Effects: Opens the vault with the current passphrase and rewrites vault.age encrypted to the reduced recipient set.

Exit status: 0 success 2 that recipient is the last one left 3 no vault at that path, or no recipient with that fingerprint 5 the vault could not be rewritten

ak secrets recovery remove <fingerprint> [flags]

Examples

  ak secrets recovery remove 4f2a1c9d0e7b3a56
  ak secrets recovery list   # print the fingerprints first

Options

  -h, --help             help for remove
      --json             Emit machine-readable JSON (implies --no-interactive)
      --no-interactive   Disable interactive prompts (CI-safe)
  -q, --quiet            Suppress non-error output on stderr
  -V, --verbose          Extra diagnostic output on stderr (loses to --quiet)
  -y, --yes              Assume yes for all prompts

SEE ALSO

• ak secrets recovery - Manage the file backend's vault and its recovery keys