xotogen

Overview ¶

Command xotogen generates credentials for an xolu server configured for tenant access control. It implements the minting procedures described in docs/proposals/tenant-access-control-operations.md:

xotogen jwt     — mint an HS256 JWT with tenant grants (scoped mode)
xotogen apikey  — generate an API key and its APIKeyGrants config block
xotogen bearer  — generate an InternalToken (bearer / trusted-gateway)
xotogen s3key   — generate an S3 access-key/secret pair and its S3KeyGrants block

The JWT signing secret is never accepted on the command line (it would leak into shell history and process listings). It is read from the XOLU_JWT_SECRET environment variable, or from a file via --secret-file.