PAT → Key Exchange

The Istari CLI includes convenience functions for replacing a PAT that your local Istari CLI or Agent(s) are using for authentication with keys.

Pre-requisites

Key exchange can only be performed when the Identity Service is enabled.

You must set the istari_digital_api_url configuration value in istari_digital_config.yaml before performing any key exchanges. The istari_digital_api_url is found as the API URL in the Endpoints section under Settings > Developer Settings in the Istari Digital Platform.

Exchanging Your PAT

You can use the stari key exchange function to exchange your PATs for keys.

Exchanging the PAT used by the Istari CLI

To exchange the PAT used by the Istari CLI and migrate it to key-based authentication, run:

stari key exchange

This will generate a new key file (equivalent to stari key generate), register it with the Istari Digital Platform (equivalent to stari key exchange), and rewrite your istari_digital_config.yaml to configure the Istari CLI to use the new key.

To exchange the PAT for an existing key file, run:

stari key exchange --key-file /path/to/key/file.json

Exchanging a PAT not used by the Istari CLI

You can also use the stari key exchange function to exchange an arbitrary PAT of yours for a key.

stari key exchange --pat "REPLACE_WITH_PAT" --output /path/to/create/key/file.json

To exchange the PAT for an existing key file, run:

stari key exchange --pat "REPLACE_WITH_PAT" --key-file /path/to/key/file.json

Exchanging an Agent's PAT

You can also use the stari key exchange function to exchange Agent PATs for keys. You must be an admin user to exchange Agent PATs.

To exchange the PAT used by the Agent on the host and migrate the Agent to key-based authentication, run:

stari key exchange --agent

More details

See the stari key exchange reference for the full set of options for stari key exchange.