ts device-key

Revoke a device key by its SHA-256 fingerprint, so the machine holding it can no longer sign in without re-enrolling.

Usage

ts device-key delete <sha256> [--force]

Description

A device key lets a client machine authenticate with a key pair instead of a password. The client generates the pair at enrollment, registers the public half with the server, and the SHA-256 fingerprint of that public key is how the key is identified afterwards.

delete is the only action. Revoking takes effect immediately: the key stops being accepted, and the device has to enroll again before it can connect. Nothing else about the account changes — the user's password, group membership, and API keys are untouched.

The command prompts before revoking. Pass --force to skip the prompt; in a script or anywhere without a terminal, --force is required rather than assumed, so an unattended run cannot hang on a question nobody will answer.

Revocation is scoped to the account you are signed in as. The server matches the fingerprint only against keys registered to your own login, so a fingerprint belonging to someone else is indistinguishable from one that does not exist — both report that the key was not found. This is one of the few ts commands that does not need Server Administrator membership, and also one you cannot use on another person's behalf.

Finding the fingerprint

There is no ts command that lists device keys.

WARNING

ts help device-key and one of the command's error messages both suggest ts device-keys for listing keys. That command does not exist in any build; running it exits 9009.

To see which devices are enrolled — and to revoke a key that belongs to someone else — use the Administration site under Identity → Device Keys. It lists every enrolled device with its user, operating system, and last-accessed time, and revokes with a button, so it never asks you for a fingerprint. That page is the practical tool for helpdesk work; ts device-key delete is for the case where you already hold the fingerprint, typically from the enrolling client or from the record kept when the device was provisioned.

Device-key revocation is not written to the operator audit log, from either surface, so ts audit will not show it.

Options

Flag	Description	Default/Values	Notes
--force, -f	Skip the confirmation prompt.		Required when there is no terminal.

Examples

# Revoke a key, confirming at the prompt
ts device-key delete 9Fq2s0Xk7bJd1mQwYzR4tV6uH8pC3nA5eL0gT2iO1xM

# Unattended, from a script
ts device-key delete 9Fq2s0Xk7bJd1mQwYzR4tV6uH8pC3nA5eL0gT2iO1xM --force

# A fingerprint registered to another user reports "not found" — revoke
# other people's device keys from the Administration site instead
ts device-key delete <someone-elses-fingerprint>

Output

Revoked device key 9Fq2s0Xk7bJd1mQwYzR4tV6uH8pC3nA5eL0gT2iO1xM

Exit Codes

0 on success. -1 when you answer no at the prompt, or when there is no terminal and --force was not passed. -4 when no account is signed in. -6 when the fingerprint does not match an active key on your own account — which covers a mistyped fingerprint, a key already revoked, and a key belonging to another user.

Related Commands

• ts api-keys — The other non-password credential, and one you can list from the CLI.
• ts user — The account a device key belongs to.
• ts logout — Invalidate login tickets; device keys survive it.