Manage SSH credentials

Credentials identify the public SSH key that may receive a Tenvyr certificate. Private keys remain on the user device.

Enroll a hardware-backed key

tenvyr key enroll --hardware --name "Primary security key"

The default auto algorithm selects a supported FIDO2 security-key algorithm. You can request one explicitly:

tenvyr key enroll \
  --hardware \
  --algorithm ed25519-sk \
  --name "Operations YubiKey"

The CLI creates the key through OpenSSH and proves possession during enrollment.

Enroll an existing key

tenvyr key enroll \
  --public-key "$HOME/.ssh/id_ed25519.pub" \
  --identity "$HOME/.ssh/id_ed25519" \
  --name "Workstation key"

Tenvyr uses a one-use SSHSIG challenge to prevent registering a public key you do not control.

Credential modes

• Hardware-backed certificate — preferred for human privileged access.
• User certificate — certificate access with a software-held key.
• Compatibility static — standing authorized-key reconciliation.
• Service — non-human use under an explicit service policy.
• Break glass — separately verified recovery credential.

If a key is lost

Notify an owner or administrator. Credential containment revokes the credential, active grants, and issued certificates and causes updated revocation state to be published to agents. Existing open SSH sessions require host or network containment.