Keys

Inventory shows labels and opaque credential ids; stored secrets are never shown.

Keys

Holder / labelKind / scopeStored key / useLast data uploadIssued / revokedActions

Issue a key

A duplicate active label for the same person and kind is refused. Node keys stay within the person’s assigned node.

Host keys

On the server host, issue a root key with tierd tokens issue --db PATH --root or a metrics key with tierd tokens issue --db PATH --metrics.

The key is shown once. Store it privately; inventory and revocation use its credential id.