CLI command reference

Every subcommand of the kryard CLI/TUI. Verified directly against kryard --help on the latest release (0.1.0).

If you just want the install + quickstart, start at CLI overview. The flags below are the full surface — including the global flags every subcommand inherits.

Global flags

These apply to every command:

Flag	Purpose
--json	machine-readable output (skip the human formatting)
--org <id>	organization id (overrides the saved default in ~/.config/kryard/config.toml)
--profile <name>	select a named config profile (default profile name lives in config)

Secrets are never accepted as a flag — they come from stdin or the OS keychain.

kryard login

Store credentials in the OS keychain. Two forms, one per auth tier:

kryard login --api-key --generate    # mint a P-256 API key; prints the PUBLIC half
kryard login --api-key               # import an existing API key: private key read from stdin
kryard login                         # device login (browser + paste-phrase flow → /dashboard/v1/*)

Flag	Tier	Purpose
--api-key	api-key	use the X-Stamp (/public/v1/*) tier
--generate	api-key	generate a fresh P-256 key instead of importing one

After --api-key --generate, register the printed public half in the console's API-Keys panel before the key can authenticate. Importing reads the private key hex from stdin (never argv) so it does not appear in ps or shell history.

The device-login flow opens a URL, you sign in with email/passkey in the browser, approve, and paste the printed phrase back into the CLI. The refresh token is stored in the OS keychain, the access JWT is cached in-memory, and rotation on expiry is automatic.

kryard logout

Revoke the device session and clear stored tokens.

kryard logout

API-key login (an offline key in the keychain) is unaffected — logout revokes the device session, not an API key. To remove an API key, delete the profile or harden-delete the key from the console.

kryard org

Select and inspect the active organization. Multi-org users need to pick one before any tier-specific operation (X-Stamp API keys are scoped to one org; the device tier surfaces all of them).

kryard org ls                  # list every org this user belongs to (device-login tier)
kryard org show                # show the effective org for the current profile
kryard org use <organization-id>  # persist the default org in the config file

org ls is the one read path unique to the device tier — a single API key cannot list the orgs the underlying human user belongs to.

kryard whoami

Show the organization the current API key / session is bound to. Verifies the keychain + config wiring against the live server in one round-trip.

kryard whoami

kryard wallets

List and inspect Kryard-custodied wallets. (wallet is an alias.)

kryard wallets ls
kryard wallets get <wallet-id>

kryard activities

List and inspect activities (the immutable unit of work + idempotency + audit).

kryard activities ls
kryard activities get <activity-id>

get returns the full activity envelope (status, intent, result, failure) in the shape documented under /signing/. With --json it is byte-identical to what @kryard/sdk returns from /public/v1/query/get_activity.

kryard sign

Sign with a Kryard-custodied key. Two subcommands:

sign raw

kryard sign raw --key <addr-or-id> --payload 0x…
# default hash: HASH_FUNCTION_KECCAK256 (EVM-style)
kryard sign raw --key <id> --payload 0x… --hash HASH_FUNCTION_SHA256

Flag	Required	Purpose
--key	yes	signWith: wallet address or private-key id
--payload	yes	hex payload to sign
--hash	no	hash function (default HASH_FUNCTION_KECCAK256); use HASH_FUNCTION_NOT_APPLICABLE for ed25519 chains that sign the message bytes directly (Solana, Sui)

sign tx

kryard sign tx --key <addr-or-id> --unsigned 0x…

Flag	Required	Purpose
--key	yes	signWith: wallet address or private-key id
--unsigned	yes	hex unsigned transaction

sign tx is the EVM transaction-signing path — see Signing for the on-the-wire shape.

kryard eoa

Manage the local EOA signing key for the relay & sponsorship lanes (your own account, NOT a Kryard-custodied one). The relayer key itself is Kryard-custodied; this is just what signs the 7702 authorization for sponsored execution.

kryard eoa import          # paste EOA private key hex from stdin → prints the address
kryard eoa address         # show the stored EOA address

Only the address is ever printed — the private key is read from stdin, stored in the OS keychain, and never re-exported.

kryard relay

Managed relay (gas tank): balance, submit, status.

relay balance

kryard relay balance

relay submit

kryard relay submit --key <relayer-addr-or-id> --chain 11155111 --to 0x… \
    [--value <wei>] [--data 0x…]
# EIP-7702 sponsored execution — signs a 7702 authorization with the stored EOA:
kryard relay submit --key <relayer> --chain 11155111 --to 0x… \
    --authorize <delegate-contract> --auth-nonce <eoa-account-nonce> \
    [--data 0x…] [--value <wei>]

Flag	Required	Purpose
--key	yes	relayer signWith: address or private-key id
--chain	yes	decimal chain id
--to	yes	recipient address
--value	no	value in wei (decimal or 0x-hex)
--data	no	calldata 0x…
--authorize	no	EIP-7702 delegate contract to authorize (signs the auth with the stored EOA)
--auth-nonce	w/ --authorize	EOA account nonce for the 7702 authorization
--gas-limit	no	explicit gas limit (else estimated server-side)
--gas-token	no	ERC-20 gas-token address (paymaster lane — see Pay gas in any token)
--gas-token-amount	no	agreed token fee the user reimburses on-chain
--speed	no	fee tier: slow / average / fast
--idempotency-key	no	dedupe key; a repeat returns the existing tx

Flags you cannot pass: the relayer nonce, fees, and (default) gas estimation are sourced server-side by the relay pipeline. --auth-nonce is the one EOA-state value the CLI requires you to source explicitly so it does not race a stale nonce.

relay status

kryard relay status <transaction-id>

Returns the relay transaction's lifecycle state — pending → confirmed / failed / expired. With --json, the same shape the SDK's client.get(id) returns.

kryard sponsor

Request ERC-4337 gas sponsorship for a v0.7 UserOperation. Kryard signs the paymaster hash; a bundler broadcasts (you supply it).

kryard sponsor --chain 11155111 --user-op ./userop.json \
    [--valid-after <unix-sec>] [--valid-until <unix-sec>]
# UserOp JSON from stdin:
cat userop.json | kryard sponsor --chain 11155111 --user-op -

Flag	Required	Purpose
--chain	yes	decimal chain id
--user-op	yes	path to a v0.7 UserOperation JSON file (- for stdin)
--valid-after	no	sponsorship signature validity lower bound (unix seconds)
--valid-until	no	sponsorship signature validity upper bound (unix seconds)

kryard tui

Launch the interactive console (Bubble Tea). All the read + write lanes above, with a tab-able dashboard. The TUI speaks either auth tier — kryard login once, then kryard tui for every session.

kryard tui