Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

auth-service commands

This page lists every auth-service command with its arguments and options. It is generated from the same definitions as auth-service --help, so --help on any command prints the same text. Administration shows the commands at work, and deploying how to run them in an environment.

Every command also accepts -h and --help.

auth-service

The Origin Auth service. Runs serve when no command is given.

auth-service [COMMAND]

Commands:

auth-service serve

Serve the authentication service.

auth-service serve

auth-service migrate

Apply database migrations. Connected as the schema owner, also create or reset the role other commands connect as.

auth-service migrate

auth-service keys

Inspect, rotate, revoke and import signing keys, check token digest keys, and print the audit key’s verifier key. Every replica picks up a signing key change within a minute.

auth-service keys <COMMAND>

Commands:

  • auth-service keys list: List signing keys with their state and dates, oldest first.
  • auth-service keys rotate: Publish a new signing key, which signs after 24 hours. Prints its ID.
  • auth-service keys revoke: Delete a signing key at once, e.g. a compromised one. When it was the active key, the next and retiring keys go with it, since their private keys were stored alongside, and a new one signs at once. Verifiers that cached it keep accepting it until their cache expires, up to an hour.
  • auth-service keys digest-usage: Count stored token digests per token digest key, to tell when AUTH_TOKEN_DIGEST_KEY_ACCEPTED can be removed.
  • auth-service keys import: Import the deployment’s PEM signing key as the active key, so tokens it signed keep verifying. Does nothing unless the key set is empty.
  • auth-service keys audit: Print the verifier key of the audit key AUTH_AUDIT_KEY_PROVIDER names, for AUTH_PUBLIC_BASE_URL’s host, to commit to docs/dev/security/audit-key.pub.

auth-service keys list

List signing keys with their state and dates, oldest first.

auth-service keys list

auth-service keys rotate

Publish a new signing key, which signs after 24 hours. Prints its ID.

auth-service keys rotate [OPTIONS]

Options:

  • --now: Sign with it at once, skipping pre-publication: verifiers that cached the previous key set reject its tokens until they fetch keys again.

auth-service keys revoke

Delete a signing key at once, e.g. a compromised one. When it was the active key, the next and retiring keys go with it, since their private keys were stored alongside, and a new one signs at once. Verifiers that cached it keep accepting it until their cache expires, up to an hour.

auth-service keys revoke <ID>

Arguments:

  • <ID>: The key’s ID.

auth-service keys digest-usage

Count stored token digests per token digest key, to tell when AUTH_TOKEN_DIGEST_KEY_ACCEPTED can be removed.

auth-service keys digest-usage

auth-service keys import

Import the deployment’s PEM signing key as the active key, so tokens it signed keep verifying. Does nothing unless the key set is empty.

auth-service keys import [OPTIONS] <REFERENCE>

Arguments:

  • <REFERENCE>: The PEM key, at file://PATH or env://NAME.

Options:

  • --id <ID>: The key’s ID, as tokens it signed name it. Default: primary.

auth-service keys audit

Print the verifier key of the audit key AUTH_AUDIT_KEY_PROVIDER names, for AUTH_PUBLIC_BASE_URL’s host, to commit to docs/dev/security/audit-key.pub.

auth-service keys audit

auth-service user

Search, show, disable, reactivate and recover accounts.

auth-service user <COMMAND>

Commands:

Search accounts by ID, or by part of a handle, display name or email, ignoring case. Lists 50 at a time, by handle.

auth-service user search [OPTIONS] [QUERY]

Arguments:

  • [QUERY]: What to look for. Lists every account when empty.

Options:

  • --page <PAGE>: The page to list, counting from 1.
  • --output <OUTPUT>: A table for people, or JSON for scripts. Default: table. Values: table (Tab-separated lines for people), json (The view the admin dashboard shows, as JSON, for scripts: its shape is sourceorigin_common’s, as its admin and alerts modules define it).

auth-service user show

Show an account’s profile, status, emails, passkeys, linked identities, sessions and consents. Recorded, since it shows personal data.

auth-service user show [OPTIONS] <USER>

Arguments:

  • <USER>: The account: its handle, ID or verified email.

Options:

  • --output <OUTPUT>: A table for people, or JSON for scripts. Default: table. Values: table (Tab-separated lines for people), json (The view the admin dashboard shows, as JSON, for scripts: its shape is sourceorigin_common’s, as its admin and alerts modules define it).

auth-service user disable

Disable an account and end its sessions and refresh tokens. Never the last active administrator’s.

auth-service user disable [OPTIONS] --reason <REASON> <USER>

Arguments:

  • <USER>: The account: its handle, ID or verified email.

Options:

  • --reason <REASON>: Why, kept with the event as personal data: 1 to 500 characters. Required.
  • --yes: Do not ask for confirmation. Required when standard input is not a terminal.

auth-service user enable

Let a disabled account sign in again.

auth-service user enable <USER>

Arguments:

  • <USER>: The account: its handle, ID or verified email.

auth-service user recover

Recover an account whose owner lost every passkey.

First lists the account’s recoveries that started, ended or were used within a probation’s length. Refuses while one is in probation: find out who used it, and undo it with user undo-recovery first. An unused link is replaced. Refuses an administrator’s account: revoke its rights first. Ends the account’s sessions, removes its unverified addresses, and sends its primary verified address a link that enrolls one passkey, within a day; prints the link too, for when there is none. Through the probation that follows, that passkey signs in but confirms no change, and any older passkey can undo the recovery. Needs AUTH_PUBLIC_BASE_URL and the token digest key, which derives the link.

auth-service user recover [OPTIONS] --reason <REASON> <USER>

Arguments:

  • <USER>: The account: its handle, ID or verified email.

Options:

  • --reason <REASON>: Why, recorded with the recovery and shown to the owner, and to whoever uses the link, in the history: what was asked, never the evidence. 1 to 500 characters. Required.
  • --revoke: The account was in someone else’s hands: also revoke every passkey not kept with --keep, the last included, unlink every social identity and withdraw every consent. The link is then only printed, and every verified address is told at once. Remove the addresses the owner does not recognize afterwards, before handing the link over.
  • --keep <KEEP>: With --revoke, a passkey the owner vouches for, which stays and can still undo the recovery. Repeatable.
  • --yes: Do not ask for confirmation. Required when standard input is not a terminal.

auth-service user delete

Schedule an active account’s deletion: it can no longer sign in, its sessions end, and it is purged after 30 days unless restored first. Never the last active administrator’s.

auth-service user delete [OPTIONS] --reason <REASON> <USER>

Arguments:

  • <USER>: The account: its handle, ID or verified email.

Options:

  • --reason <REASON>: Why, kept with the event as personal data: 1 to 500 characters. Required.
  • --immediately: Purge the account now, in any status, without a grace period. This cannot be undone.
  • --yes: Do not ask for confirmation. Required when standard input is not a terminal.

auth-service user undo-recovery

Undo an account’s recovery for its owner, once they are confirmed.

For an owner with no passkey left from before it, or whose account is disabled. In probation, removes its passkey, even the last, withdraws every consent, and ends every session and refresh grant; its link unused, cancels the link.

auth-service user undo-recovery [OPTIONS] --reason <REASON> <USER>

Arguments:

  • <USER>: The account: its handle, ID or verified email.

Options:

  • --reason <REASON>: Why, recorded with each change and shown to the owner in their history: 1 to 500 characters. Required.
  • --yes: Do not ask for confirmation. Required when standard input is not a terminal.

auth-service user restore

Restore an account scheduled for deletion, so it can sign in again.

auth-service user restore --reason <REASON> <USER>

Arguments:

  • <USER>: The account: its handle, ID or verified email.

Options:

  • --reason <REASON>: Why, kept with the event as personal data: 1 to 500 characters. Required.

auth-service session

End an account’s sessions.

auth-service session <COMMAND>

Commands:

auth-service session revoke

End one session and its applications’ refresh tokens.

auth-service session revoke <SESSION>

Arguments:

  • <SESSION>: The session’s ID, as user show lists it.

auth-service session revoke-all

End every session of an account and its applications’ refresh tokens.

auth-service session revoke-all [OPTIONS] <USER>

Arguments:

  • <USER>: The account: its handle, ID or verified email.

Options:

  • --yes: Do not ask for confirmation. Required when standard input is not a terminal.

auth-service invite

Create, list and revoke signup invitations.

auth-service invite <COMMAND>

Commands:

auth-service invite create

Print a single-use signup link. Only its digest is stored, so it is shown only this once.

auth-service invite create [OPTIONS]

Options:

  • --expires-in <EXPIRES_IN>: How long the link stays valid, e.g. 24h or 7d. Default: 7d.

auth-service invite list

List invitations, newest first, without their links.

auth-service invite list [OPTIONS]

Options:

  • --output <OUTPUT>: A table for people, or JSON for scripts. Default: table. Values: table (Tab-separated lines for people), json (The view the admin dashboard shows, as JSON, for scripts: its shape is sourceorigin_common’s, as its admin and alerts modules define it).

auth-service invite revoke

Revoke an unredeemed invitation.

auth-service invite revoke <ID>

Arguments:

  • <ID>: The invitation’s ID, as invite list shows it.

auth-service client

Register, inspect and change OIDC clients. Changes apply to the next request.

auth-service client <COMMAND>

Commands:

auth-service client create

Register a client. A confidential client’s secret is printed once.

auth-service client create [OPTIONS] --name <NAME> --redirect-uri <REDIRECT_URIS> <ID>

Arguments:

  • <ID>: The client’s ID: 1 to 64 characters from A-Z, a-z, 0-9, ‘.’, ‘_’ and ‘-’.

Options:

  • --name <NAME>: The name consent screens show. Required.
  • --redirect-uri <REDIRECT_URIS>: An authorization callback, matched exactly; repeat for several. Required.
  • --post-logout-uri <POST_LOGOUT_URIS>: A page the browser may return to after logout; repeat for several.
  • --scope <SCOPES>: A scope the client may request; repeat for several. Defaults to openid, profile and email.
  • --confidential: The client runs on a server and authenticates with a secret.
  • --refresh: The client may receive refresh tokens when it requests offline_access.
  • --trusted: The client skips the consent screen. Only for first-party clients.
  • --require-par: The client must push its authorization requests (RFC 9126), so none of their parameters travel through the browser.
  • --backchannel-logout-uri <BACKCHANNEL_LOGOUT_URI>: Where auth posts a logout token when a session the client holds tokens from ends (OIDC Back-Channel Logout); HTTPS with a public address.

auth-service client apply

Register a client, or update it to match, with the secret its deployment generated: for clients a deployment manages, from its deployment job. Records nothing when the client already matches.

auth-service client apply [OPTIONS] --name <NAME> --redirect-uri <REDIRECT_URIS> <ID>

Arguments:

  • <ID>: The client’s ID: 1 to 64 characters from A-Z, a-z, 0-9, ‘.’, ‘_’ and ‘-’.

Options:

  • --name <NAME>: The name consent screens show. Required.
  • --redirect-uri <REDIRECT_URIS>: An authorization callback, matched exactly; repeat for several. Required.
  • --post-logout-uri <POST_LOGOUT_URIS>: A page the browser may return to after logout; repeat for several.
  • --scope <SCOPES>: A scope the client may request; repeat for several. Defaults to openid, profile and email.
  • --confidential: The client runs on a server and authenticates with a secret.
  • --refresh: The client may receive refresh tokens when it requests offline_access.
  • --trusted: The client skips the consent screen. Only for first-party clients.
  • --require-par: The client must push its authorization requests (RFC 9126), so none of their parameters travel through the browser.
  • --backchannel-logout-uri <BACKCHANNEL_LOGOUT_URI>: Where auth posts a logout token when a session the client holds tokens from ends (OIDC Back-Channel Logout); HTTPS with a public address.
  • --secret <REFERENCE>: A confidential client’s secret, at file://PATH or env://NAME: 32 random bytes in unpadded base64url, generated by its deployment. Never printed.
  • --grace <GRACE>: How long earlier secrets keep working once the secret changes, so the running deployment keeps signing in until it rolls out. Default: 1h.

auth-service client list

List every client, deleted ones included.

auth-service client list [OPTIONS]

Options:

  • --output <OUTPUT>: A table for people, or JSON for scripts. Default: table. Values: table (Tab-separated lines for people), json (The view the admin dashboard shows, as JSON, for scripts: its shape is sourceorigin_common’s, as its admin and alerts modules define it).

auth-service client show

Print a client’s registration and its secrets’ lifetimes as JSON.

auth-service client show <ID>

Arguments:

  • <ID>: The client’s ID.

auth-service client update

Change a client’s registration; what is not given keeps its value.

auth-service client update [OPTIONS] <ID>

Arguments:

  • <ID>: The client’s ID.

Options:

  • --name <NAME>: A new name for consent screens.
  • --add-redirect-uri <ADD_REDIRECT_URIS>: An authorization callback to add; repeat for several.
  • --remove-redirect-uri <REMOVE_REDIRECT_URIS>: An authorization callback to remove, exactly as registered; repeat for several.
  • --add-post-logout-uri <ADD_POST_LOGOUT_URIS>: A post-logout page to add; repeat for several.
  • --remove-post-logout-uri <REMOVE_POST_LOGOUT_URIS>: A post-logout page to remove, exactly as registered; repeat for several.
  • --scope <SCOPES>: Replaces the scopes the client may request; repeat for several.
  • --refresh: Allow refresh tokens.
  • --no-refresh: Stop issuing refresh tokens; existing ones stop working.
  • --trusted: Skip the consent screen.
  • --untrusted: Show the consent screen again.
  • --require-par: Require pushed authorization requests.
  • --no-require-par: Accept authorization requests sent through the browser again.
  • --backchannel-logout-uri <BACKCHANNEL_LOGOUT_URI>: Post logout tokens to this URI instead.
  • --no-backchannel-logout-uri: Stop posting logout tokens to the client.

auth-service client disable

Stop a client from authorizing, exchanging codes and refreshing tokens.

auth-service client disable [OPTIONS] <ID>

Arguments:

  • <ID>: The client’s ID.

Options:

  • --yes: Do not ask for confirmation. Required when standard input is not a terminal.

auth-service client delete

Delete a client: it stops working at once, its refresh tokens, secrets and consents go, and its ID can never be registered again.

auth-service client delete [OPTIONS] <ID>

Arguments:

  • <ID>: The client’s ID.

Options:

  • --yes: Do not ask for confirmation. Required when standard input is not a terminal.

auth-service client enable

Let a disabled client work again.

auth-service client enable <ID>

Arguments:

  • <ID>: The client’s ID.

auth-service client suspend

Block a client: it is disabled, and its owner cannot enable it again until unsuspend.

auth-service client suspend [OPTIONS] <ID>

Arguments:

  • <ID>: The client’s ID.

Options:

  • --yes: Do not ask for confirmation. Required when standard input is not a terminal.

auth-service client unsuspend

Lift a client’s suspension. It stays disabled until enabled.

auth-service client unsuspend <ID>

Arguments:

  • <ID>: The client’s ID.

auth-service client rotate-secret

Print a new secret for a confidential client. Earlier secrets keep working during the grace period, while the client switches to the new one.

auth-service client rotate-secret [OPTIONS] <ID>

Arguments:

  • <ID>: The client’s ID.

Options:

  • --grace <GRACE>: How long earlier secrets keep working, e.g. 30m, 24h or 7d; 0 revokes them now. Default: 24h.

auth-service client origin

Approve, remove or list the origins whose pages may sign users in with their passkeys, without sending them to auth’s pages.

auth-service client origin <COMMAND>

Commands:

auth-service client origin add

Approve an origin. The client must be trusted and have a redirect URI on it, and approved origins may span at most 5 domains, as browsers honour.

auth-service client origin add <ID> <ORIGIN>

Arguments:

  • <ID>: The client’s ID.
  • <ORIGIN>: The origin, as browsers send it, e.g. https://notes.example.

auth-service client origin remove

Remove an origin: its pages stop signing users in.

auth-service client origin remove <ID> <ORIGIN>

Arguments:

  • <ID>: The client’s ID.
  • <ORIGIN>: The origin, as approved.

auth-service client origin list

List every approved origin.

auth-service client origin list [OPTIONS]

Options:

  • --output <OUTPUT>: A table for people, or JSON for scripts. Default: table. Values: table (Tab-separated lines for people), json (The view the admin dashboard shows, as JSON, for scripts: its shape is sourceorigin_common’s, as its admin and alerts modules define it).

auth-service audit

Page through, verify and prune the audit history.

auth-service audit <COMMAND>

Commands:

  • auth-service audit list: Page through recorded events, newest first.
  • auth-service audit verify: Recompute the chain and check every checkpoint against it, and record what it found, which the dashboard’s Audit tab shows. Exits non-zero, naming the first position that does not match, when the chain is broken.
  • auth-service audit prune: Delete the events through a checkpoint, once the chain verifies through it. The checkpoint becomes the anchor the remaining chain extends. Connects as the schema owner when AUTH_DATABASE_OWNER_URL is set: auth’s own role may not delete events.

auth-service audit list

Page through recorded events, newest first.

auth-service audit list [OPTIONS]

Options:

  • --user <USER>: Only events concerning this account: its handle, ID or verified email.
  • --kind <KIND>: Only events of this kind, e.g. session_revoked.
  • --views: List administrators’ and operators’ views of accounts too, which are left out unless --kind account_viewed asks for them.
  • --page <PAGE>: The page to list, counting from 1 at the newest events.
  • --output <OUTPUT>: A table for people, or JSON for scripts. Default: table. Values: table (Tab-separated lines for people), json (The view the admin dashboard shows, as JSON, for scripts: its shape is sourceorigin_common’s, as its admin and alerts modules define it).

auth-service audit verify

Recompute the chain and check every checkpoint against it, and record what it found, which the dashboard’s Audit tab shows. Exits non-zero, naming the first position that does not match, when the chain is broken.

auth-service audit verify [OPTIONS]

Options:

  • --key <KEY>: A file of verifier keys, one per line, to use instead of the keys committed to the repository for AUTH_PUBLIC_BASE_URL’s host, e.g. a preview’s, as keys audit prints it.
  • --output <OUTPUT>: A table for people, or JSON for scripts. Default: table. Values: table (Tab-separated lines for people), json (The view the admin dashboard shows, as JSON, for scripts: its shape is sourceorigin_common’s, as its admin and alerts modules define it).

auth-service audit prune

Delete the events through a checkpoint, once the chain verifies through it. The checkpoint becomes the anchor the remaining chain extends. Connects as the schema owner when AUTH_DATABASE_OWNER_URL is set: auth’s own role may not delete events.

auth-service audit prune [OPTIONS] --through <THROUGH>

Options:

  • --through <THROUGH>: The position of the checkpoint to prune through. Required.
  • --key <KEY>: A file of verifier keys, one per line, to use instead of the keys committed to the repository for AUTH_PUBLIC_BASE_URL’s host, e.g. a preview’s, as keys audit prints it.
  • --yes: Do not ask for confirmation. Required when standard input is not a terminal.

auth-service admin

Grant, revoke or list administrators.

auth-service admin <COMMAND>

Commands:

auth-service admin grant

Make an active account an administrator.

Refuses while a recovery of the account can still be undone: granted during its probation, the rights would go live for whoever used its link once it settles.

auth-service admin grant <USER>

Arguments:

  • <USER>: The account: its handle, ID or verified email.

auth-service admin revoke

Remove an account’s administrator rights. The last active administrator keeps theirs.

auth-service admin revoke [OPTIONS] <USER>

Arguments:

  • <USER>: The account: its handle, ID or verified email.

Options:

  • --yes: Do not ask for confirmation. Required when standard input is not a terminal.

auth-service admin list

List administrators, oldest grant first.

auth-service admin list [OPTIONS]

Options:

  • --output <OUTPUT>: A table for people, or JSON for scripts. Default: table. Values: table (Tab-separated lines for people), json (The view the admin dashboard shows, as JSON, for scripts: its shape is sourceorigin_common’s, as its admin and alerts modules define it).

auth-service handle

Check accounts against the handle rules, and change their handles.

auth-service handle <COMMAND>

Commands:

auth-service handle check

List accounts whose handle is reserved.

auth-service handle check

auth-service handle rename

Give an account a new handle, without the settings cooldown, and record the change.

auth-service handle rename [OPTIONS] --reason <REASON> <USER> <NEW>

Arguments:

  • <USER>: The account: its current handle, ID or verified email.
  • <NEW>: Its new handle.

Options:

  • --reason <REASON>: Why, kept with the event as personal data: 1 to 500 characters. Required.
  • --allow-reserved: Allow a reserved name, or one that looks like it.

auth-service handle release

Delete a released handle, or a purged account’s last one, so anyone may claim it again, e.g. after a trademark dispute. An account’s current handle is never released: rename the account first.

auth-service handle release <HANDLE>

Arguments:

  • <HANDLE>: The released handle.

auth-service handle released

List released handles and purged accounts’ last ones, which release frees.

auth-service handle released

auth-service handle reserved

List the handles administrators reserved, then the built-in reserved names.

auth-service handle reserved

auth-service handle reserve

Reserve a handle: signup and the settings refuse it and its look-alikes until an administrator gives it with rename --allow-reserved, or unreserves it.

auth-service handle reserve --reason <REASON> <HANDLE>

Arguments:

  • <HANDLE>: The handle.

Options:

  • --reason <REASON>: Who or what it is kept for: 1 to 500 characters. Required.

auth-service handle unreserve

Remove a handle from the reserved list, so anyone may claim it again.

auth-service handle unreserve <HANDLE>

Arguments:

  • <HANDLE>: The handle.

auth-service deliveries

Inspect, retry and cancel outbound deliveries.

auth-service deliveries <COMMAND>

Commands:

auth-service deliveries list

List deliveries, newest first.

auth-service deliveries list [OPTIONS]

Options:

  • --status <STATUS>: Only deliveries with this status: pending, succeeded, failed or cancelled.
  • --channel <CHANNEL>: Only deliveries on this channel.
  • --limit <LIMIT>: The most deliveries to list. Default: 100.

auth-service deliveries retry

Attempt a failed delivery, or a cancelled unordered one, again now.

auth-service deliveries retry <ID>

Arguments:

  • <ID>: The delivery’s ID.

auth-service deliveries cancel

Cancel a pending or failed delivery, which unblocks the deliveries ordered after it.

auth-service deliveries cancel <ID>

Arguments:

  • <ID>: The delivery’s ID.

auth-service announcement

Draft, send and read announcements to accounts, such as a security incident or a change to the privacy policy.

auth-service announcement <COMMAND>

Commands:

auth-service announcement list

List announcements, drafts and sent ones, newest first.

auth-service announcement list [OPTIONS]

Options:

  • --output <OUTPUT>: A table for people, or JSON for scripts. Default: table. Values: table (Tab-separated lines for people), json (The view the admin dashboard shows, as JSON, for scripts: its shape is sourceorigin_common’s, as its admin and alerts modules define it).

auth-service announcement show

Show an announcement: its text, whom it goes to, how many of them its email reaches, and once sent, how its emails fared.

auth-service announcement show [OPTIONS] <ID>

Arguments:

  • <ID>: The announcement’s ID, as announcement list shows it.

Options:

  • --output <OUTPUT>: A table for people, or JSON for scripts. Default: table. Values: table (Tab-separated lines for people), json (The view the admin dashboard shows, as JSON, for scripts: its shape is sourceorigin_common’s, as its admin and alerts modules define it).

auth-service announcement draft

Draft an announcement, and print its ID. Nothing is sent yet.

auth-service announcement draft [OPTIONS] --subject <SUBJECT> --body-file <BODY_FILE>

Options:

  • --subject <SUBJECT>: The email’s subject: one line of up to 150 characters. Required.
  • --body-file <BODY_FILE>: The file holding the text, or - for standard input: up to 20,000 characters, paragraphs separated by blank lines. The email starts with “Hello,” and ends with “SourceOrigin”. Required.
  • --everyone: Send it to every account, as of its sending.
  • --to <TO>: Send it to this account, by handle, ID or verified email. Repeat for up to 1,000 accounts.
  • --essential: Email it to every recipient with a primary verified address, even those who turned announcements’ email off: for a security incident, or a change to the privacy policy or terms. Without it, they only find it in their inbox.

auth-service announcement edit

Replace a draft’s subject, text and recipients.

auth-service announcement edit [OPTIONS] --subject <SUBJECT> --body-file <BODY_FILE> <ID>

Arguments:

  • <ID>: The draft’s ID.

Options:

  • --subject <SUBJECT>: The email’s subject: one line of up to 150 characters. Required.
  • --body-file <BODY_FILE>: The file holding the text, or - for standard input: up to 20,000 characters, paragraphs separated by blank lines. The email starts with “Hello,” and ends with “SourceOrigin”. Required.
  • --everyone: Send it to every account, as of its sending.
  • --to <TO>: Send it to this account, by handle, ID or verified email. Repeat for up to 1,000 accounts.
  • --essential: Email it to every recipient with a primary verified address, even those who turned announcements’ email off: for a security incident, or a change to the privacy policy or terms. Without it, they only find it in their inbox.

auth-service announcement discard

Delete a draft.

auth-service announcement discard <ID>

Arguments:

  • <ID>: The draft’s ID.

auth-service announcement send

Send a draft: email it to each recipient with a primary verified address, and put it in every recipient’s inbox. It cannot be taken back.

auth-service announcement send [OPTIONS] --revision <REVISION> <ID>

Arguments:

  • <ID>: The draft’s ID.

Options:

  • --revision <REVISION>: The revision announcement show printed, which is sent only if the draft has not changed since. Required.
  • --yes: Do not ask for confirmation. Required when standard input is not a terminal.

auth-service alerts

List the alerts that need an administrator’s attention, and post updates on them.

auth-service alerts <COMMAND>

Commands:

  • auth-service alerts list: List the current alerts, newest first, each with where its handling stands.
  • auth-service alerts update: Post an update on a current alert, saying where its handling stands. The first acknowledges it: it stops counting as a warning, though it stays current while its condition holds. A new alert is raised if the condition changes, or clears and comes back.

auth-service alerts list

List the current alerts, newest first, each with where its handling stands.

auth-service alerts list [OPTIONS]

Options:

  • --previous: List the alerts that cleared instead, the most recently cleared first, at most 100.
  • --output <OUTPUT>: A table for people, or JSON for scripts. Default: table. Values: table (Tab-separated lines for people), json (The view the admin dashboard shows, as JSON, for scripts: its shape is sourceorigin_common’s, as its admin and alerts modules define it).

auth-service alerts update

Post an update on a current alert, saying where its handling stands. The first acknowledges it: it stops counting as a warning, though it stays current while its condition holds. A new alert is raised if the condition changes, or clears and comes back.

auth-service alerts update [OPTIONS] --status <STATUS> <ID>

Arguments:

  • <ID>: The alert’s ID.

Options:

  • --status <STATUS>: Where its handling stands: investigating, fixing or monitoring. Required.
  • --note <NOTE>: What to add, such as who is on it: 1 to 500 characters.

auth-service account

Read or change one account’s settings on its owner’s behalf.

auth-service account <USER> <COMMAND>

Arguments:

  • <USER>: The account: its handle, ID or verified email.

Commands:

auth-service account name

Change the display name.

auth-service account <USER> name <COMMAND>

Commands:

auth-service account name set

Change the display name, which applications receive as name once they refresh the profile.

auth-service account <USER> name set --reason <REASON> <NAME>

Arguments:

  • <NAME>: The new name: at most 80 characters, not blank.

Options:

  • --reason <REASON>: Why: 1 to 500 characters, recorded with the change. The account’s owner sees it in their security history. Required.

auth-service account passkeys

List, rename or remove passkeys.

auth-service account <USER> passkeys <COMMAND>

Commands:

auth-service account passkeys list

List the active passkeys.

auth-service account <USER> passkeys list [OPTIONS]

Options:

  • --output <OUTPUT>: A table for people, or JSON for scripts. Default: table. Values: table (Tab-separated lines for people), json (The view the admin dashboard shows, as JSON, for scripts: its shape is sourceorigin_common’s, as its admin and alerts modules define it).

auth-service account passkeys rename

Rename a passkey.

auth-service account <USER> passkeys rename --reason <REASON> <PASSKEY> <NAME>

Arguments:

  • <PASSKEY>: The passkey’s ID, as list shows it.
  • <NAME>: The new name.

Options:

  • --reason <REASON>: Why: 1 to 500 characters, recorded with the change. The account’s owner sees it in their security history. Required.

auth-service account passkeys revoke

Remove a passkey and sign the account out everywhere. One passkey always remains.

auth-service account <USER> passkeys revoke [OPTIONS] --reason <REASON> <PASSKEY>

Arguments:

  • <PASSKEY>: The passkey’s ID, as list shows it.

Options:

  • --reason <REASON>: Why: 1 to 500 characters, recorded with the change. The account’s owner sees it in their security history. Required.
  • --yes: Do not ask for confirmation. Required when standard input is not a terminal.

auth-service account identities

List or unlink social sign-ins.

auth-service account <USER> identities <COMMAND>

Commands:

auth-service account identities list

List the linked providers.

auth-service account <USER> identities list [OPTIONS]

Options:

  • --output <OUTPUT>: A table for people, or JSON for scripts. Default: table. Values: table (Tab-separated lines for people), json (The view the admin dashboard shows, as JSON, for scripts: its shape is sourceorigin_common’s, as its admin and alerts modules define it).

Unlink a provider and sign the account out everywhere.

auth-service account <USER> identities unlink [OPTIONS] --reason <REASON> <PROVIDER>

Arguments:

  • <PROVIDER>: The provider: github or google.

Options:

  • --reason <REASON>: Why: 1 to 500 characters, recorded with the change. The account’s owner sees it in their security history. Required.
  • --yes: Do not ask for confirmation. Required when standard input is not a terminal.

auth-service account emails

List email addresses, choose the primary one, or remove one.

auth-service account <USER> emails <COMMAND>

Commands:

auth-service account emails list

List the addresses, primary first.

auth-service account <USER> emails list [OPTIONS]

Options:

  • --output <OUTPUT>: A table for people, or JSON for scripts. Default: table. Values: table (Tab-separated lines for people), json (The view the admin dashboard shows, as JSON, for scripts: its shape is sourceorigin_common’s, as its admin and alerts modules define it).

auth-service account emails primary

Make a verified address the primary one, which applications receive. The previous one is told.

auth-service account <USER> emails primary --reason <REASON> <EMAIL>

Arguments:

  • <EMAIL>: The address’s ID, as list shows it.

Options:

  • --reason <REASON>: Why: 1 to 500 characters, recorded with the change. The account’s owner sees it in their security history. Required.

auth-service account emails remove

Remove an address, which is told if it was verified. The primary address goes last.

auth-service account <USER> emails remove --reason <REASON> <EMAIL>

Arguments:

  • <EMAIL>: The address’s ID, as list shows it.

Options:

  • --reason <REASON>: Why: 1 to 500 characters, recorded with the change. The account’s owner sees it in their security history. Required.

auth-service account sessions

List sessions, or sign them out.

auth-service account <USER> sessions <COMMAND>

Commands:

auth-service account sessions list

List the active sessions, most recently active first.

auth-service account <USER> sessions list [OPTIONS]

Options:

  • --output <OUTPUT>: A table for people, or JSON for scripts. Default: table. Values: table (Tab-separated lines for people), json (The view the admin dashboard shows, as JSON, for scripts: its shape is sourceorigin_common’s, as its admin and alerts modules define it).

auth-service account sessions revoke

Sign one session out, with its applications’ refresh tokens.

auth-service account <USER> sessions revoke --reason <REASON> <SESSION>

Arguments:

  • <SESSION>: The session’s ID, as list shows it.

Options:

  • --reason <REASON>: Why: 1 to 500 characters, recorded with the change. The account’s owner sees it in their security history. Required.

auth-service account sessions revoke-all

Sign every session out, with their applications’ refresh tokens.

auth-service account <USER> sessions revoke-all [OPTIONS] --reason <REASON>

Options:

  • --reason <REASON>: Why: 1 to 500 characters, recorded with the change. The account’s owner sees it in their security history. Required.
  • --yes: Do not ask for confirmation. Required when standard input is not a terminal.

auth-service account apps

List the apps that keep access, or remove one’s access.

auth-service account <USER> apps <COMMAND>

Commands:

auth-service account apps list

List the apps, by name.

auth-service account <USER> apps list [OPTIONS]

Options:

  • --output <OUTPUT>: A table for people, or JSON for scripts. Default: table. Values: table (Tab-separated lines for people), json (The view the admin dashboard shows, as JSON, for scripts: its shape is sourceorigin_common’s, as its admin and alerts modules define it).

auth-service account apps remove

Remove an app’s access: its refresh grants end and it asks for consent again. The account’s sessions stay signed in.

auth-service account <USER> apps remove --reason <REASON> <CLIENT>

Arguments:

  • <CLIENT>: The app’s client ID, as list shows it.

Options:

  • --reason <REASON>: Why: 1 to 500 characters, recorded with the change. The account’s owner sees it in their security history. Required.

auth-service account picture

Show or remove the profile picture.

auth-service account <USER> picture <COMMAND>

Commands:

auth-service account picture show

Show the picture’s ID, path on auth and when it was uploaded.

auth-service account <USER> picture show [OPTIONS]

Options:

  • --output <OUTPUT>: A table for people, or JSON for scripts. Default: table. Values: table (Tab-separated lines for people), json (The view the admin dashboard shows, as JSON, for scripts: its shape is sourceorigin_common’s, as its admin and alerts modules define it).

auth-service account picture remove

Remove the picture, such as one that impersonates someone.

auth-service account <USER> picture remove --reason <REASON>

Options:

  • --reason <REASON>: Why: 1 to 500 characters, recorded with the change. The account’s owner sees it in their security history. Required.

auth-service account history

Page through the security history as the owner sees it, newest first.

auth-service account <USER> history [OPTIONS]

Options:

  • --before <BEFORE>: Continue with entries older than this one, the last one listed.
  • --output <OUTPUT>: A table for people, or JSON for scripts. Default: table. Values: table (Tab-separated lines for people), json (The view the admin dashboard shows, as JSON, for scripts: its shape is sourceorigin_common’s, as its admin and alerts modules define it).

auth-service account notifications

Read the account’s notifications, as its inbox shows them. Reading one never marks it read.

auth-service account <USER> notifications <COMMAND>

Commands:

auth-service account notifications list

List the notifications, newest first.

auth-service account <USER> notifications list [OPTIONS]

Options:

  • --before <BEFORE>: Continue with notifications older than this one, the last one listed.
  • --output <OUTPUT>: A table for people, or JSON for scripts. Default: table. Values: table (Tab-separated lines for people), json (The view the admin dashboard shows, as JSON, for scripts: its shape is sourceorigin_common’s, as its admin and alerts modules define it).

auth-service account notifications show

Show one notification, with its security history entry while kept.

auth-service account <USER> notifications show [OPTIONS] <NOTIFICATION>

Arguments:

  • <NOTIFICATION>: The notification, as list shows it.

Options:

  • --output <OUTPUT>: A table for people, or JSON for scripts. Default: table. Values: table (Tab-separated lines for people), json (The view the admin dashboard shows, as JSON, for scripts: its shape is sourceorigin_common’s, as its admin and alerts modules define it).

auth-service account notifications preferences

Show which categories of notifications the account receives by email. Only the owner changes them, since turning one off could hide a notice from them.

auth-service account <USER> notifications preferences [OPTIONS]

Options:

  • --output <OUTPUT>: A table for people, or JSON for scripts. Default: table. Values: table (Tab-separated lines for people), json (The view the admin dashboard shows, as JSON, for scripts: its shape is sourceorigin_common’s, as its admin and alerts modules define it).