Tenant Token Commands

A tenant token is a named secret value scoped to a tenant. A token’s value can be supplied directly (from an environment variable, a file, a literal value, or an interactive masked prompt), or resolved through an external credential provider by referencing a credential source, secret path, and property name instead of storing the value directly.

Create and Update Tokens

Create a token with a directly supplied value, using --value-source in the same env:NAME, file:PATH, literal:VALUE, or prompt: form used elsewhere in Dodeca Shell:

dshell/SAMPLE:>tenant-token-create --id ApiKey --value-source env:SAMPLE_API_KEY

Create a token that instead resolves through an external credential provider, by specifying its credential source, secret path, and property name:

dshell/SAMPLE:>tenant-token-create --id DbPassword --credential-source CorporateVault --secret-path secret/data/databases/reporting --property-name password

Specify either --value-source, or all three of --credential-source, --secret-path, and --property-name — not both. tenant-token-update takes the same options to change an existing token’s value or source:

dshell/SAMPLE:>tenant-token-update --id ApiKey --value-source prompt:

List, Inspect, and Delete Tokens

List every tenant token defined in the current tenant:

dshell/SAMPLE:>tenant-token-list

Show a single token’s metadata (its kind, and either its external credential source/secret path/property, as applicable — not the resolved secret value itself):

dshell/SAMPLE:>tenant-token-get --id ApiKey

Delete a token, with a confirmation prompt unless --force is given:

dshell/SAMPLE:>tenant-token-delete --id ApiKey
dshell/SAMPLE:>tenant-token-delete --id ApiKey --force