# ry protect

> Give an app a protected view (password or share link).

```text
ry protect [options] [command]
```

## Subcommands

### `ry protect status`

Show whether an app is protected and which share links exist.

```text
ry protect status [options] [app]
```

Arguments:

- `[app]`: The app (default: "app" from rytiv.json in this directory or above).

Example:

```bash
ry protect status web
```

### `ry protect password`

Protect an app with a password (asked interactively, never as an argument).

```text
ry protect password [options] <app>
```

Options:

- `--generate`: Generate a password instead of asking, and print it once.

Example:

```bash
ry protect password web
```

### `ry protect link`

Create a share link - one address the customer opens once.

```text
ry protect link [options] <app>
```

Options:

- `--label <label>`: Who this link is for, e.g. "client Smith" - a revoke needs something to aim at.
- `--expires <when>`: 30d, 12h or an ISO date. Without it the link does not expire.

Example:

```bash
ry protect link web --label "client Smith"
```

### `ry protect links`

List the share links of an app.

```text
ry protect links [options] [app]
```

Arguments:

- `[app]`: The app (default: "app" from rytiv.json in this directory or above).

Example:

```bash
ry protect links web
```

### `ry protect revoke`

Revoke one share link - it stops working within ~2 seconds.

```text
ry protect revoke [options] <app> <link-id>
```

Example:

```bash
ry protect revoke web lnk-1a2b3c4d
```

### `ry protect rotate`

Sign everybody out immediately - the password and the links stay valid.

```text
ry protect rotate [options] <app>
```

Example:

```bash
ry protect rotate web
```

### `ry protect off`

Make an app public again.

```text
ry protect off [options] <app>
```

Options:

- `-y, --yes`: Skip confirmation (required for automation).

Example:

```bash
ry protect off web
```

### `ry protect signed`

Only visitors with a token signed by your org get in - everybody else sees "no app with that name".

```text
ry protect signed [options] <app>
```

Example:

```bash
ry protect signed web
```

### `ry protect token`

Mint an access token for a signed app with your org's platform key.

```text
ry protect token [options] <app>
```

Options:

- `--ttl <duration>`: How long the token can be redeemed, e.g. 60s, 30m, 1d (default 60s, at most 1d).
- `--sub <id>`: Who it is for - goes into the token, for your own logs.
- `--next <path>`: Where the browser lands after redeeming the URL (default /).

Example:

```bash
ry protect token web
```

### `ry protect keys`

The public keys a partner signs access tokens with (org-wide).

```text
ry protect keys [options] [command]
```

#### `ry protect keys list`

List the org's partner keys.

```text
ry protect keys list [options]
```

Example:

```bash
ry protect keys list
```

#### `ry protect keys add`

Register an Ed25519 public key - tokens signed with its private half name it as kid.

```text
ry protect keys add [options]
```

Options:

- `--label <label>`: What signs with it, e.g. "portal" - a removal needs something to aim at.
- `--public-key <file-or-key>`: PEM file, or the raw 32 bytes as base64/base64url.

Example:

```bash
ry protect keys add --label portal --public-key ./portal.pub
```

#### `ry protect keys remove`

Remove a partner key - new sign-ins with it fail within ~2 seconds.

```text
ry protect keys remove [options] <id>
```

Options:

- `-y, --yes`: Skip confirmation (required for automation).

Example:

```bash
ry protect keys remove key-1a2b3c4d
```

### `ry protect settings`

Show or set your org's settings for signed apps: cookie lifetime and who may frame them.

```text
ry protect settings [options]
```

Options:

- `--cookie-ttl <duration>`: How long a signed visitor stays signed in, e.g. 1h (60s to 1d).
- `--frame-ancestors <origins>`: Comma-separated origins that may frame the loading page, or none.

Example:

```bash
ry protect settings
```