StoreEnv Beta
Documentation

Install the CLI, learn the model and look up every command.

CLI reference

storeenv revoke

Remove a member's access and re-key what they could read.

Global flags
zsh
$ cd ~/code/my-app
$ storeenv revoke @bea --yes
  @bea could read 2 secrets.
  @bea can no longer read ada/my-app.
  Re-keying (new ESKs, re-wrapped for remaining members)... done
 
  ! They may have copied these values. Rotate them at the provider:
      API_URL, PORT     (marked "rotation due")
$ storeenv revoke [user]

Arguments

<user>The member to remove, as @username.

Flags

--resumeFinish a re-key that is still pending.
--rotationMark the affected secrets as rotation due. Default: true.
--skip-unverifiedEncrypt only for readers whose keys are verified; the rest wait for a key share.

Good to know

  • Access ends at once. The secrets they could read get new keys and are marked rotation due.
  • If they copied values, only rotating them at the provider protects you. Push the new values afterwards.

Related commands

storeenv grantstoreenv membersstoreenv push

Global flags

--project <value>Project as <namespace/name> or its id (default: .storeenv.json, then this repository's remotes).
--env <value>Environment name.
--jsonMachine readable output.
--yes, -ySkip confirmations.
--colorColoured output (--no-color to turn off). Default: true.
--verboseShow debug details.
--api <value>API base URL of a self-hosted StoreEnv.
--trust-writer <value>Trust a writer for this run: @login=SE:XXXX-XXXX-XXXX.
--allow-unsignedpull and diff: use values that aren't signed by a trusted writer, after you confirm on a terminal (or with STOREENV_ALLOW_UNSIGNED=1). Never applies to run or copy.
Previous grant Next share