opschain admin agent-release keygen
packs:agentspacks:agent-governance
opschain admin agent-release keygen --name <key name> --out <private key file>
Generates an Ed25519 signing keypair locally and registers the public
half on the server as an active signing key in the key registry's
agent-release slice. The private key is written to --out
(mode 0600, base64) and never reaches the server; an existing file is
never overwritten. The output names the key by id and fingerprint only.
Flags
| Flag | Meaning |
|---|---|
--name <name> | Key name (the signing team or pipeline). |
--out <file> | File the private key is written to (0600, base64). |
--note <text> | Optional note stored with the key. |
--server <url> | Server base URL. Default: the active context, then OPSCHAIN_SERVER. |
Output
The registered key's id, name and fingerprint, and where the private key
was written. Keep that file offline — it is what sign (and the inline signing mode
of create) signs releases with.