Skip to main content
Last updated: 2026-09-06
orca keys manages tenant API keys: the ao_ bearer keys that authenticate the CLI, the SDKs, and any direct caller of the /api/* control plane. A key inherits the role of whoever minted it. These are not the same as chat keys, which authenticate callers of a published agent through the gateway; those are managed with orca agents keys. Every subcommand accepts the global flags. orca keys create prompts for a name when it is omitted in a terminal; in a pipe or script the name is required (exit code 2). Destructive subcommands prompt for confirmation in a terminal; in a script --yes is required or the command refuses (exit code 2).

​
orca keys list

Lists every tenant API key with its id, name, role, creation time, last use, and state (active, expires <time>, or revoked). There are no page flags; the server returns the full set from GET /api/api-keys.
Plain (piped) output is one tab-separated row per key: id, name, role, createdAt, lastUsedAt (or -), state. With --json the array of key metadata records is printed (no tokens; the server stores only a hash).

​
orca keys create

Issues a new tenant API key. The plaintext token is shown exactly once and cannot be retrieved again. In a terminal it is revealed with a framed prompt; when stdout is a pipe, stdout carries only the token and the key’s name and id go to stderr, so scripts can capture it directly; with --json the full issued-key record, including token, is printed.

​
orca keys revoke

Revokes a tenant API key by id. Anything authenticating with it stops working immediately.
Verified against orca-cli cli-v0.5.0.