# Keys commands

Signatures, flags and examples for recala keys.

## Use these commands

Organization API keys, where key access is enabled. A person’s session manages keys.

Examples assume you have signed in and selected the intended organization. Set shell variables such as `ARTICLE_ID` to ids from the corresponding list command. Set `PUBLICATION_TIME` to a future local time in YYYY-MM-DDTHH:MM format.

Badges describe the command’s strongest effect; a preview or read-only option may do less. [Guarded writes can require confirmation even without --yes](https://recala.co/developers/agents/#guarded). “Needs a person” covers identity, consent and credentials.

### [`recala keys create`](https://recala.co/developers/cli/keys/#cmd-keys-create)

Create a key. It is printed once; Recala keeps only its hash.

needs a person Acts on an organization [Supports --yes](https://recala.co/developers/agents/#guarded)

```
recala keys create [OPTIONS]
```

Replace [OPTIONS] with your flags. Include every flag marked Required in the table below.

| Flag | Required | Description |
| --- | --- | --- |
| `--json` | No | Print one JSON document (errors as JSON on stderr). |
| `--org` | No | Organization name, slug or id (else RECALA_ORG, else recala org use). |
| `--yes` | No | Only with an API key holding publish: approve, schedule or unpublish without a prompt. |
| `--name` | Yes | What the key is for, e.g. "Claude agent". |
| `--scope` | Yes | Repeat for each scope. |
| `--expires-days` | No | No description supplied by the CLI. |
| `--rate` | No | Requests per minute. |
| `--credit-cap` | No | Articles per month. |
| `--publish-cap` | No | Articles approved or published per day. |
| `--sign-as` | No | Your own email: needed for a key that can approve and publish. |
| `--person` | No | With publish: a person (id from recala authors) whose articles this key may approve and publish. Repeat for each. |

#### Examples

Run in your terminal with the intended organization selected.

```
recala keys create --name "CI reports" --scope read --credit-cap 0 --publish-cap 0
```

**Exit codes:** [`0` OK](https://recala.co/developers/reference/#exit-0), [`1` ERROR](https://recala.co/developers/reference/#exit-1), [`2` USAGE](https://recala.co/developers/reference/#exit-2), [`3` NOT_AUTHENTICATED](https://recala.co/developers/reference/#exit-3), [`4` FORBIDDEN](https://recala.co/developers/reference/#exit-4), [`5` NOT_FOUND](https://recala.co/developers/reference/#exit-5), [`6` CONFLICT](https://recala.co/developers/reference/#exit-6), [`7` INVALID](https://recala.co/developers/reference/#exit-7), [`8` RATE_LIMITED](https://recala.co/developers/reference/#exit-8), [`9` UNAVAILABLE](https://recala.co/developers/reference/#exit-9), [`10` CONFIRMATION_REQUIRED](https://recala.co/developers/reference/#exit-10), [`11` PAYMENT_REQUIRED](https://recala.co/developers/reference/#exit-11).

API commands share the CLI’s HTTP error mapping. [Read human and JSON output rules](https://recala.co/developers/reference/#json-output).

### [`recala keys events`](https://recala.co/developers/cli/keys/#cmd-keys-events)

The key's audit trail, newest first.

needs a person Acts on an organization

```
recala keys events KEY_ID [OPTIONS]
```

Replace uppercase arguments with your own values. Replace [OPTIONS] with the flags you need, or omit it.

| Flag | Required | Description |
| --- | --- | --- |
| `--json` | No | Print one JSON document (errors as JSON on stderr). |
| `--org` | No | Organization name, slug or id (else RECALA_ORG, else recala org use). |
| `--limit` | No | No description supplied by the CLI. |

#### Examples

Set the named shell variables to your own values before running.

```
recala keys events "$KEY_ID"
```

**Exit codes:** [`0` OK](https://recala.co/developers/reference/#exit-0), [`1` ERROR](https://recala.co/developers/reference/#exit-1), [`2` USAGE](https://recala.co/developers/reference/#exit-2), [`3` NOT_AUTHENTICATED](https://recala.co/developers/reference/#exit-3), [`4` FORBIDDEN](https://recala.co/developers/reference/#exit-4), [`5` NOT_FOUND](https://recala.co/developers/reference/#exit-5), [`6` CONFLICT](https://recala.co/developers/reference/#exit-6), [`7` INVALID](https://recala.co/developers/reference/#exit-7), [`8` RATE_LIMITED](https://recala.co/developers/reference/#exit-8), [`9` UNAVAILABLE](https://recala.co/developers/reference/#exit-9), [`11` PAYMENT_REQUIRED](https://recala.co/developers/reference/#exit-11).

API commands share the CLI’s HTTP error mapping. [Read human and JSON output rules](https://recala.co/developers/reference/#json-output).

### [`recala keys list`](https://recala.co/developers/cli/keys/#cmd-keys-list)

Owners see every key of the company; others see their own.

needs a person Acts on an organization

```
recala keys list [OPTIONS]
```

Replace [OPTIONS] with the flags you need, or omit it.

| Flag | Required | Description |
| --- | --- | --- |
| `--json` | No | Print one JSON document (errors as JSON on stderr). |
| `--org` | No | Organization name, slug or id (else RECALA_ORG, else recala org use). |

#### Examples

Set the named shell variables to your own values before running.

```
recala keys list
```

**Exit codes:** [`0` OK](https://recala.co/developers/reference/#exit-0), [`1` ERROR](https://recala.co/developers/reference/#exit-1), [`2` USAGE](https://recala.co/developers/reference/#exit-2), [`3` NOT_AUTHENTICATED](https://recala.co/developers/reference/#exit-3), [`4` FORBIDDEN](https://recala.co/developers/reference/#exit-4), [`5` NOT_FOUND](https://recala.co/developers/reference/#exit-5), [`6` CONFLICT](https://recala.co/developers/reference/#exit-6), [`7` INVALID](https://recala.co/developers/reference/#exit-7), [`8` RATE_LIMITED](https://recala.co/developers/reference/#exit-8), [`9` UNAVAILABLE](https://recala.co/developers/reference/#exit-9), [`11` PAYMENT_REQUIRED](https://recala.co/developers/reference/#exit-11).

API commands share the CLI’s HTTP error mapping. [Read human and JSON output rules](https://recala.co/developers/reference/#json-output).

### [`recala keys revoke`](https://recala.co/developers/cli/keys/#cmd-keys-revoke)

Revoke a key: its next request is refused.

needs a person Acts on an organization [Supports --yes](https://recala.co/developers/agents/#guarded)

```
recala keys revoke KEY_ID [OPTIONS]
```

Replace uppercase arguments with your own values. Replace [OPTIONS] with the flags you need, or omit it.

| Flag | Required | Description |
| --- | --- | --- |
| `--json` | No | Print one JSON document (errors as JSON on stderr). |
| `--org` | No | Organization name, slug or id (else RECALA_ORG, else recala org use). |
| `--yes` | No | Only with an API key holding publish: approve, schedule or unpublish without a prompt. |

#### Examples

Set the named shell variables to your own values before running.

```
recala keys revoke "$KEY_ID"
```

**Exit codes:** [`0` OK](https://recala.co/developers/reference/#exit-0), [`1` ERROR](https://recala.co/developers/reference/#exit-1), [`2` USAGE](https://recala.co/developers/reference/#exit-2), [`3` NOT_AUTHENTICATED](https://recala.co/developers/reference/#exit-3), [`4` FORBIDDEN](https://recala.co/developers/reference/#exit-4), [`5` NOT_FOUND](https://recala.co/developers/reference/#exit-5), [`6` CONFLICT](https://recala.co/developers/reference/#exit-6), [`7` INVALID](https://recala.co/developers/reference/#exit-7), [`8` RATE_LIMITED](https://recala.co/developers/reference/#exit-8), [`9` UNAVAILABLE](https://recala.co/developers/reference/#exit-9), [`10` CONFIRMATION_REQUIRED](https://recala.co/developers/reference/#exit-10), [`11` PAYMENT_REQUIRED](https://recala.co/developers/reference/#exit-11).

API commands share the CLI’s HTTP error mapping. [Read human and JSON output rules](https://recala.co/developers/reference/#json-output).