Docs · the operator CLI
signetctl.
Operate a Signet instance from the terminal: the same verbs the Admin API contract documents, plus the two the console cannot give you and the ADK in executable form. Version 0.1.0, engine commit 06bcd58690ed. This reference is generated from the tool’s own --help tree, so it cannot drift from what ships.
What it is not. signetctl is an operator tool and an agent on-ramp, not a client library. Your application still uses the stock better-auth client; there is no Signet SDK to learn, and this tool does not change that.
signetctl --help
Operate a Signet instance from the terminal — the same verbs the Admin API documents
Usage: signetctl [OPTIONS] <COMMAND>
Commands:
stats Instance stats: users, active sessions, sign-ins per day, delivery and rate-limit counters
users Manage users
sessions Manage sessions
api-keys Mint declared-permission API keys for users
app-users Manage tenant/application-scoped end-user populations
service-principals List and create stable tenant-owned service identities
ssh-machine-issuers Register trusted issuers for machine SSH task assertions
authorization-roles List and define persisted D150 roles in an exact platform or organization scope
principal-role-grants List and grant persisted authorization roles to principals
grants Manage tenant-scoped grants over opaque principal, resource, and capability strings
service-tokens Mint credentials for existing service identities
tokens Token inventory and revocation
signing-keys Ed25519 JWKS trust-root lifecycle (platform admin only)
platform-credentials Managed platform-administrator credential lifecycle (platform admin only)
messages Send fixed, permission-scoped operational messages
deliveries Delivery dead-letters (undeliverable emails/webhooks)
events Event dead-letters
config Instance configuration
audit Admin audit log
differential-verify Compare paired credentials at Signet and a pluggable predecessor without making either authoritative
vault Encrypted secrets — R195. Available only on an instance built with the `vault` feature AND licensed for it; otherwise every verb here reports which of the two gates refused and what to do about it
doctor Diagnose an instance end to end: alias redirects, admin surface health, route currency, delivery
quickstart Emit working auth wiring for a named stack
agent Agent harness + REPL: your own OpenAI-compatible endpoint drives the CLI's verbs (BYO LLM; nothing leaves your perimeter)
mcp Model Context Protocol surface
help Print this message or the help of the given subcommand(s)
Options:
--url <URL> Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
--admin-key <ADMIN_KEY> Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
-h, --help Print help
-V, --version Print versionTwo verbs the console does not have.
signetctl doctor diagnoses an instance end to end, including the four failures that present as something else: an instance URL that is a redirecting alias, a build too old for a route the caller wants, an admin API that is unmounted rather than rejecting the key, and delivery that is configured but dead.
signetctl quickstart <curl|node|next|python> emits working auth wiring for a named stack, from the tool rather than from prose.
The ADK, executable.
signetctl agent runs the agent harness against your own OpenAI-compatible endpoint: a TUI REPL on a terminal, headless with -p, and --output-format stream-json so Claude Code or any harness can drive it as a subprocess. There is no default LLM and no telemetry; the loop talks only to your instance and your endpoint, so it runs where the server runs, including air-gapped. signetctl mcp serve exposes the same verbs as a stateless MCP server (2026-07-28 revision) with durable tasks that survive a client restart.
Every verb.
signetctl doctor
Diagnose an instance end to end: alias redirects, admin surface health, route currency, delivery
Usage: signetctl doctor [OPTIONS]
Options:
--url <URL> Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
--admin-key <ADMIN_KEY> Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
-h, --help Print helpsignetctl quickstart
Emit working auth wiring for a named stack
Usage: signetctl quickstart [OPTIONS] <STACK>
Arguments:
<STACK> Target stack [possible values: curl, node, next, python]
Options:
--url <URL> Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
--admin-key <ADMIN_KEY> Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
-h, --help Print helpsignetctl agent
The ADK on-ramp in executable form: an agent loop where every tool is a signetctl subcommand and every action is a recorded command. Interactive TUI REPL on a terminal; headless with -p/--output-format text|json|stream-json so other harnesses (Claude Code, CI) can drive it. BYO OpenAI-compatible endpoint — there is no default LLM and no telemetry.
Usage: signetctl agent [OPTIONS] [PROMPT]
Arguments:
[PROMPT]
What you want done, e.g. "create a user and show their sessions"
Options:
--endpoint <ENDPOINT>
OpenAI-compatible endpoint base, e.g. http://localhost:11434/v1 — yours, not ours
[env: SIGNET_AGENT_ENDPOINT=]
--url <URL>
Instance origin, e.g. https://auth.example.com (canonical host, not an alias)
[env: SIGNET_URL=]
--admin-key <ADMIN_KEY>
Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
--model <MODEL>
Model name at that endpoint, e.g. deepseek-v4-flash:0731-cloud
[env: SIGNET_AGENT_MODEL=]
--api-key <API_KEY>
API key for that endpoint, if it needs one
[env: SIGNET_AGENT_API_KEY]
-p, --print
Headless: run the prompt, print, exit (never opens the REPL)
--output-format <OUTPUT_FORMAT>
Output format for headless runs
[default: text]
[possible values: text, json, stream-json]
--list-tools
Print the derived tool list (one per CLI verb) and exit
--max-turns <MAX_TURNS>
Maximum model turns before stopping
[default: 25]
-h, --help
Print help (see a summary with '-h')signetctl mcp
Model Context Protocol surface
Usage: signetctl mcp [OPTIONS] <COMMAND>
Commands:
serve Serve the command tree as a stateless MCP server on stdio
help Print this message or the help of the given subcommand(s)
Options:
--url <URL> Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
--admin-key <ADMIN_KEY> Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
-h, --help Print helpsignetctl stats
Instance stats: users, active sessions, sign-ins per day, delivery and rate-limit counters
Usage: signetctl stats [OPTIONS]
Options:
--url <URL> Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
--admin-key <ADMIN_KEY> Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
-h, --help Print helpsignetctl users
Manage users
Usage: signetctl users [OPTIONS] <COMMAND>
Commands:
list List users, newest first, with substring search over email and name
create Create a user
set-role Set a user's role or roles
delete IRREVERSIBLE: delete a user and every row they own
ban Ban a user (reversible) — revokes their sessions and user-backed credentials
unban Lift a user's ban
unlock Clear a lockout/escalation state, addressed by email
sessions List a user's sessions
revoke-all Revoke every session belonging to a user
help Print this message or the help of the given subcommand(s)
Options:
--url <URL> Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
--admin-key <ADMIN_KEY> Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
-h, --help Print helpsignetctl sessions
Manage sessions
Usage: signetctl sessions [OPTIONS] <COMMAND>
Commands:
revoke Revoke one session by its at-rest token reference (as listed by `users sessions`)
help Print this message or the help of the given subcommand(s)
Options:
--url <URL> Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
--admin-key <ADMIN_KEY> Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
-h, --help Print helpsignetctl tokens
Token inventory and revocation
Usage: signetctl tokens [OPTIONS] <COMMAND>
Commands:
list List the token inventory, keyset-paged (use --cursor, not offset)
config Show the token-kind registry
get Show one token record by handle
revoke Revoke one token
revoke-principal Review or atomically revoke one service principal's exact active credential estate
help Print this message or the help of the given subcommand(s)
Options:
--url <URL> Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
--admin-key <ADMIN_KEY> Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
-h, --help Print helpsignetctl deliveries
Delivery dead-letters (undeliverable emails/webhooks)
Usage: signetctl deliveries [OPTIONS] <COMMAND>
Commands:
dead-letters List delivery dead-letters
replay Replay one dead-lettered delivery
help Print this message or the help of the given subcommand(s)
Options:
--url <URL> Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
--admin-key <ADMIN_KEY> Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
-h, --help Print helpsignetctl events
Event dead-letters
Usage: signetctl events [OPTIONS] <COMMAND>
Commands:
dead-letters List event dead-letters
deliveries List durable event-delivery retry state and terminal rollup receipts
replay Replay one dead-lettered event
help Print this message or the help of the given subcommand(s)
Options:
--url <URL> Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
--admin-key <ADMIN_KEY> Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
-h, --help Print helpsignetctl config
Instance configuration
Usage: signetctl config [OPTIONS] <COMMAND>
Commands:
show Show the instance's effective configuration (secrets absent by construction)
help Print this message or the help of the given subcommand(s)
Options:
--url <URL> Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
--admin-key <ADMIN_KEY> Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
-h, --help Print helpsignetctl audit
Admin audit log
Usage: signetctl audit [OPTIONS] <COMMAND>
Commands:
export Export the complete admin audit log as NDJSON to stdout, traversing bounded keyset pages
help Print this message or the help of the given subcommand(s)
Options:
--url <URL> Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
--admin-key <ADMIN_KEY> Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
-h, --help Print helpHow it arrives: signetctl ships with hosted onboarding and enterprise delivery. There is no public download, for the same reason there is no installer: a first deployment is an engagement, and the tool arrives with it.