rekor tokens

Manage API tokens

Subcommands

rekor tokens create

Create a scoped API token

• --name <name> — Token name
• --grants <json> — Grant definitions as JSON array
• --expires-at <date> — Expiration date (ISO 8601, e.g., 2026-06-01T00:00:00Z)

rekor tokens create-for-toolset <slug>

Create a toolset-bound (consumer) token whose authorization IS the toolset tool surface — it can call exactly the tools that toolset exposes (those record_types + operations, relationships, batch, and sql only if enabled) and nothing else. Binds to the configured --base.

• --name <name> — Token name (default: "<slug> consumer")
• --expires-at <date> — Expiration date (ISO 8601, e.g., 2026-06-01T00:00:00Z)

rekor tokens list

List API tokens

rekor tokens revoke <token_id>

Revoke an API token