CLI reference

insecur is experimental and prelaunch. There is no public sign-up yet, and the hosted service is not approved for valuable production secrets. Local Mode runs the development loop with no account.

insecur connections

Manage org-scoped App Connections (metadata only)

insecur connections [options] [command]

`insecur connections list`

List App Connections for the selected organization

insecur connections list [options]

`insecur connections create`

Create an App Connection via provider authorization or scoped token input

insecur connections create [options] <provider>

Argument	Description
`provider`	provider slug (github, cloudflare, vercel)

Option	Description
`--connection-id <id>`	client-minted app connection opaque id (required)
`--method <method>`	connection method (github-app, scoped-api-token, ...) (required)
`--display-name-stdin`	read the Display Name from stdin
`--value-stdin`	read provider token from stdin (credential-backed methods)
`--token <value>`	REJECTED: provider tokens must not be passed on argv
`--allow-account-id <id>`	Cloudflare allowed account id (boundary)
`--allow-worker-script <name>`	Cloudflare allowed Worker script (boundary)
`--installation-id <id>`	GitHub App installation id (boundary)
`--owner <name>`	GitHub owner login (boundary)
`--allowed-repositories <repos>`	comma-separated GitHub repository names (boundary)
`--operation <id>`	resume after High-Assurance Challenge clearance

`insecur connections status`

Show metadata-only App Connection status

insecur connections status [options] <connection-id>

Argument	Description
`connection-id`	app connection opaque id

`insecur connections rotate`

Rotate credential-backed App Connection provider credentials

insecur connections rotate [options] <connection-id>

Argument	Description
`connection-id`	app connection opaque id

Option	Description
`--dry-run`	validate the active credential without replacing it
`--value-stdin`	read replacement provider token from stdin
`--token <value>`	REJECTED: provider tokens must not be passed on argv
`--operation <id>`	resume after High-Assurance Challenge clearance

`insecur connections reauth`

Reauthorize an App Connection with audit

insecur connections reauth [options] <connection-id>

Argument	Description
`connection-id`	app connection opaque id

Option	Description
`--installation-id <id>`	GitHub App installation id (boundary override)
`--owner <name>`	GitHub owner login (boundary override)
`--allowed-repositories <repos>`	comma-separated GitHub repository names (boundary)
`--operation <id>`	resume after High-Assurance Challenge clearance

`insecur connections disconnect`

Disconnect an App Connection with audit

insecur connections disconnect [options] <connection-id>

Argument	Description
`connection-id`	app connection opaque id