ts device-key

Revoke a person's sign-in key by its SHA-256 fingerprint, so the computer holding it can no longer sign that person in.

Usage

ts device-key delete <sha256> [--force]

Description

A sign-in key lets a person's computer sign them in with a key pair instead of a password. The client generates the pair, registers the public half with the server, and the SHA-256 fingerprint of that public key is how the key is identified afterwards.

delete is the only action. Revoking takes effect immediately: the key stops being accepted, and the computer has to register a key again before it can sign the person in. Nothing else about the account changes — the person's password and group membership are untouched.

This command covers a person's sign-in keys only. A device that signs in as itself, one a deployment enrolled or one a person registered as their own, has its own key, which goes with the device: disable or delete it with ts device.

The command prompts before revoking. Pass --force to skip the prompt; in a script or anywhere without a terminal, --force is required rather than assumed, so an unattended run cannot hang on a question nobody will answer.

Any signed-in account can revoke its own sign-in keys, and a Server Administrator can revoke anyone's. For any other account, the server matches the fingerprint only against keys registered to its own login, so a fingerprint belonging to someone else is indistinguishable from one that does not exist — both report that the key was not found. Every revocation is recorded in the audit log, naming the key and the person it belonged to.

Finding the fingerprint

There is no ts command that lists sign-in keys. To see them, use the Administration site under Identity → Device Keys. It lists every key with its person, operating system, and last-accessed time, and revokes with a button, so it never asks you for a fingerprint. ts device-key delete is for the case where you already hold the fingerprint, typically from that page or from the enrolling client.

Options

Flag	Description	Default/Values	Notes
--force, -f	Skip the confirmation prompt.		Required when there is no terminal.

Examples

# Revoke a key, confirming at the prompt
ts device-key delete 9Fq2s0Xk7bJd1mQwYzR4tV6uH8pC3nA5eL0gT2iO1xM

# Unattended, from a script
ts device-key delete 9Fq2s0Xk7bJd1mQwYzR4tV6uH8pC3nA5eL0gT2iO1xM --force

# Without Server Administrator membership, a fingerprint registered to another
# person reports "not found"
ts device-key delete <someone-elses-fingerprint>

Output

Revoked device key 9Fq2s0Xk7bJd1mQwYzR4tV6uH8pC3nA5eL0gT2iO1xM

Exit Codes

0 on success. -1 when no fingerprint is given, when the action is not delete, when you answer no at the prompt, or when there is no terminal and --force was not passed. -4 when no account is signed in. -6 when the fingerprint does not match a live sign-in key the account may revoke — which covers a mistyped fingerprint, a key already revoked, and, without Server Administrator membership, a key belonging to another person.

Related Commands

• ts device — Devices that sign in as themselves, whose own keys go with them.
• ts user — The account a sign-in key belongs to.
• ts logout — Ends a ts sign-in; sign-in keys survive it.
• ts audit — Who revoked a key, and when.