Documentation
¶
Overview ¶
Command lease-token mints a Fred tenant bearer token (ADR-036 signed) from a real BIP39 mnemonic, for authenticating to lease endpoints such as POST /v1/leases/{lease_uuid}/restore.
Usage:
FRED_MNEMONIC="word1 word2 ... word24" \
lease-token -tenant manifest1... \
-lease-uuid <NEW lease uuid in the request path>
The mnemonic is the tenant's full secret key material, so it is NEVER accepted as a command-line flag (argv is world-readable via /proc and lands in shell history). Provide it via the $FRED_MNEMONIC environment variable, or pipe it on stdin: echo "$MNEMONIC" | lease-token -tenant ... -lease-uuid ...
The token is bound to the lease UUID in the request path (the restore handler enforces token.lease_uuid == path lease_uuid), so -lease-uuid must be the NEW lease UUID, not the source lease being restored from. Tokens are valid for a short window (server MaxTokenAge is 30s), so mint immediately before use.
It prints the base64 bearer token to stdout (followed by a newline for readability). To use it:
TOKEN=$(FRED_MNEMONIC="$MNEMONIC" lease-token -tenant "$TENANT" -lease-uuid "$UUID") curl -H "Authorization: Bearer $TOKEN" ...
Source Files