Overview of Identity Service client keys
Identity Service client keys are ECDSA P-384 keypairs used for private-key authentication as an alternative to Personal Access Tokens (PATs). Once a key is generated and registered, the CLI must be pointed to it using stari client init --identity-service.
There are three primary workflows for obtaining a registered key:
- Exchange a PAT: Use
stari key exchangeto quickly swap a working PAT for a registered key. - Generate and Register: Use
stari key generate(offline) followed bystari key register(online). - Provision New Agent: Use
stari key generate --agent <env>followed bystari key create-agentfor agents that do not yet exist.