ConsentKeys CLI

Privacy-first identity infrastructure from your terminal.

Create OAuth applications, authenticate users, and generate app-specific identities without storing personal data.

Installation

npm install -g consentkeys

Or run instantly:

npx consentkeys

Requires Node.js 18 or later.

What is ConsentKeys?

ConsentKeys is an identity system that replaces user records with deterministic, app-specific pseudonyms.

• No emails or personal data required
• No cross-application identity leakage
• Same input → same identity (per app)
• Fully compatible with OAuth 2.0 / OIDC flows

Quick Start

# Authenticate (opens browser via device flow)
consentkeys login

# Create an OAuth application
consentkeys apps create

# List your applications
consentkeys apps list

# Check your current identity
consentkeys whoami

Example: App Setup in Seconds

consentkeys login
consentkeys apps create --name "My App"
consentkeys apps list

Commands

Authentication

| Command | Description | | -------------------- | ---------------------------------------------------------- | | consentkeys login | Authenticate via device authorization flow (opens browser) | | consentkeys logout | Clear stored credentials | | consentkeys whoami | Display current authenticated identity |

Application Management

| Command | Description | | ----------------------------------------- | ------------------------ | | consentkeys apps list | List all applications | | consentkeys apps create | Create a new application | | consentkeys apps get <id> | Get application details | | consentkeys apps update <id> | Update an application | | consentkeys apps delete <id> | Delete an application | | consentkeys apps regenerate-secret <id> | Regenerate client secret |

The <id> parameter accepts either the Client ID (e.g. ck_abc123...) or the internal UUID.

Configuration

| Command | Description | | -------------------------------------- | ---------------------------------- | | consentkeys config set api-url <url> | Set the API server URL | | consentkeys config get api-url | Display the current API server URL |

Non-Interactive Mode

All app management commands support non-interactive execution for CI/CD pipelines and scripting.

Creating an app without prompts

consentkeys apps create \
  --name "My App" \
  --redirect-uris "https://example.com/callback" \
  --scopes "openid,email"

Optional flags: --description, --website-url, --privacy-policy-url, --terms-of-service-url, --require-pkce

Updating an app

consentkeys apps update ck_abc123 \
  --name "New Name" \
  --redirect-uris "https://new.com/cb"

Only modified fields are sent to the API.

Destructive operations

Use --yes / -y to skip confirmation:

consentkeys apps delete ck_abc123 --yes
consentkeys apps regenerate-secret ck_abc123 --yes

Hybrid mode

When flags are partially provided in a TTY, the CLI prompts only for missing values and uses provided flags as defaults.

JSON output

All app commands support machine-readable output via --json:

consentkeys apps list --json
consentkeys apps create \
  --name "Test" \
  --redirect-uris "https://x.com/cb" \
  --scopes "openid" \
  --json

• Success → stdout (single JSON line)
• Errors → stderr {"error":"...","message":"..."}

Valid Scopes

openid, profile, email, address

Configuration Files

Stored in ~/.consentkeys/:

| File | Purpose | | ------------------ | ------------------------------- | | config.json | API URL and CLI settings | | credentials.json | OAuth tokens (access + refresh) |

All files are created with restrictive permissions (0o600).

Default API URL: https://api.consentkeys.com

License

UNLICENSED — All rights reserved.