CLI reference
ry protect
Give an app a protected view (password or share link).
ry protect [options] [command]Subcommands
Section titled “Subcommands”ry protect status
Section titled “ry protect status”Show whether an app is protected and which share links exist.
ry protect status [options] [app]Arguments:
[app]: The app (default: “app” from rytiv.json in this directory or above).
Example:
ry protect status webry protect password
Section titled “ry protect password”Protect an app with a password (asked interactively, never as an argument).
ry protect password [options] <app>Options:
--generate: Generate a password instead of asking, and print it once.
Example:
ry protect password webry protect link
Section titled “ry protect link”Create a share link - one address the customer opens once.
ry protect link [options] <app>Options:
--label <label>: Who this link is for, e.g. “client Smith” - a revoke needs something to aim at.--expires <when>: 30d, 12h or an ISO date. Without it the link does not expire.
Example:
ry protect link web --label "client Smith"ry protect links
Section titled “ry protect links”List the share links of an app.
ry protect links [options] [app]Arguments:
[app]: The app (default: “app” from rytiv.json in this directory or above).
Example:
ry protect links webry protect revoke
Section titled “ry protect revoke”Revoke one share link - it stops working within ~2 seconds.
ry protect revoke [options] <app> <link-id>Example:
ry protect revoke web lnk-1a2b3c4dry protect rotate
Section titled “ry protect rotate”Sign everybody out immediately - the password and the links stay valid.
ry protect rotate [options] <app>Example:
ry protect rotate webry protect off
Section titled “ry protect off”Make an app public again.
ry protect off [options] <app>Options:
-y, --yes: Skip confirmation (required for automation).
Example:
ry protect off webry protect signed
Section titled “ry protect signed”Only visitors with a token signed by your org get in - everybody else sees “no app with that name”.
ry protect signed [options] <app>Example:
ry protect signed webry protect token
Section titled “ry protect token”Mint an access token for a signed app with your org’s platform key.
ry protect token [options] <app>Options:
--ttl <duration>: How long the token can be redeemed, e.g. 60s, 30m, 1d (default 60s, at most 1d).--sub <id>: Who it is for - goes into the token, for your own logs.--next <path>: Where the browser lands after redeeming the URL (default /).
Example:
ry protect token webry protect keys
Section titled “ry protect keys”The public keys a partner signs access tokens with (org-wide).
ry protect keys [options] [command]ry protect keys list
Section titled “ry protect keys list”List the org’s partner keys.
ry protect keys list [options]Example:
ry protect keys listry protect keys add
Section titled “ry protect keys add”Register an Ed25519 public key - tokens signed with its private half name it as kid.
ry protect keys add [options]Options:
--label <label>: What signs with it, e.g. “portal” - a removal needs something to aim at.--public-key <file-or-key>: PEM file, or the raw 32 bytes as base64/base64url.
Example:
ry protect keys add --label portal --public-key ./portal.pubry protect keys remove
Section titled “ry protect keys remove”Remove a partner key - new sign-ins with it fail within ~2 seconds.
ry protect keys remove [options] <id>Options:
-y, --yes: Skip confirmation (required for automation).
Example:
ry protect keys remove key-1a2b3c4dry protect settings
Section titled “ry protect settings”Show or set your org’s settings for signed apps: cookie lifetime and who may frame them.
ry protect settings [options]Options:
--cookie-ttl <duration>: How long a signed visitor stays signed in, e.g. 1h (60s to 1d).--frame-ancestors <origins>: Comma-separated origins that may frame the loading page, or none.
Example:
ry protect settings