ak secrets recovery init

Use ak secrets recovery init for the operation described below. The command help records its arguments, effects, and options.

Command contract

Create the vault and print its first recovery key once

Synopsis

Create the age-encrypted vault, seal it under a passphrase you choose now, and generate one recovery keypair. The private half is shown once and stored nowhere: save it the way you would a password, somewhere the host itself cannot reach. If you lose both the passphrase and every recovery key, the vault cannot be opened by anyone, including AgentKit. Refuses to run when a vault already exists.

Effects: Prompts twice for a new passphrase, then writes vault.age and vault.key.age (both 0600) under AgentKit home. Prints the recovery private key to stderr and waits for you to acknowledge it, or writes it to --print-to with mode 0600.

Exit status: 0 success 2 no safe place to put the private key, or an empty label 4 a vault already exists at that path 5 the vault could not be written

ak secrets recovery init [flags]

Examples

  ak secrets recovery init --label laptop-card
  ak secrets recovery init --label ci-card --print-to ./recovery.key   # non-interactive

Options

  -h, --help              help for init
      --json              Emit machine-readable JSON (implies --no-interactive)
      --label string      Label recorded for this recovery key (default "recovery-key-1")
      --no-interactive    Disable interactive prompts (CI-safe)
      --print-to string   Write the recovery private key to this path (created 0600) instead of showing it on the terminal
  -q, --quiet             Suppress non-error output on stderr
  -V, --verbose           Extra diagnostic output on stderr (loses to --quiet)
  -y, --yes               Assume yes for all prompts

SEE ALSO

• ak secrets recovery - Manage the file backend's vault and its recovery keys