> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kombify.io/llms.txt
> Use this file to discover all available pages before exploring further.

# stackkit identity

> Manage the standalone local identity plane

Manage the standalone local identity plane.

```bash theme={null}
stackkit identity [flags]
```

Subcommands: [`stackkit identity projection`](#stackkit-identity-projection), [`stackkit identity workload-peer`](#stackkit-identity-workload-peer)

## stackkit identity projection

Inspect and locally approve credential-free desired identity projections.

```bash theme={null}
stackkit identity projection [flags]
```

Subcommands: [`stackkit identity projection apply`](#stackkit-identity-projection-apply), [`stackkit identity projection approve`](#stackkit-identity-projection-approve), [`stackkit identity projection inspect`](#stackkit-identity-projection-inspect), [`stackkit identity projection unlink`](#stackkit-identity-projection-unlink)

### stackkit identity projection apply

Apply one previously approved projection to local PocketID.

```bash theme={null}
stackkit identity projection apply [flags]
```

| Flag                  | Type   | Default | Description                                          |
| --------------------- | ------ | ------- | ---------------------------------------------------- |
| `--json`              | bool   | —       | Emit stackkit.command-result/v1 JSON                 |
| `--owner-approve`     | bool   | —       | Explicitly approve this local identity operation     |
| `--projection-sha256` | string | —       | Exact sha256:\<hex> of a locally approved projection |

### stackkit identity projection approve

Create the local Owner-signed approval without PocketID mutation.

```bash theme={null}
stackkit identity projection approve [flags]
```

| Flag              | Type   | Default | Description                                                             |
| ----------------- | ------ | ------- | ----------------------------------------------------------------------- |
| `--file`          | string | —       | Path to a canonical stackkit.desired-identity-projection/v1 document    |
| `--json`          | bool   | —       | Emit stackkit.command-result/v1 JSON                                    |
| `--owner-approve` | bool   | —       | Explicitly approve importing this desired projection into local custody |

### stackkit identity projection inspect

Verify one signed projection without mutation.

```bash theme={null}
stackkit identity projection inspect [flags]
```

| Flag     | Type   | Default | Description                                                          |
| -------- | ------ | ------- | -------------------------------------------------------------------- |
| `--file` | string | —       | Path to a canonical stackkit.desired-identity-projection/v1 document |
| `--json` | bool   | —       | Emit stackkit.command-result/v1 JSON                                 |

### stackkit identity projection unlink

Detach optional sync without deleting any local identity.

```bash theme={null}
stackkit identity projection unlink [flags]
```

| Flag                  | Type   | Default | Description                                          |
| --------------------- | ------ | ------- | ---------------------------------------------------- |
| `--json`              | bool   | —       | Emit stackkit.command-result/v1 JSON                 |
| `--owner-approve`     | bool   | —       | Explicitly approve this local identity operation     |
| `--projection-sha256` | string | —       | Exact sha256:\<hex> of a locally approved projection |

## stackkit identity workload-peer

Exchange owner-approved Cloud workload certificates with Home.

```bash theme={null}
stackkit identity workload-peer [flags]
```

Subcommands: [`stackkit identity workload-peer enroll`](#stackkit-identity-workload-peer-enroll), [`stackkit identity workload-peer install`](#stackkit-identity-workload-peer-install), [`stackkit identity workload-peer probe`](#stackkit-identity-workload-peer-probe), [`stackkit identity workload-peer request`](#stackkit-identity-workload-peer-request), [`stackkit identity workload-peer revoke`](#stackkit-identity-workload-peer-revoke)

### stackkit identity workload-peer enroll

Issue and admit a peer for one installed Home publication.

```bash theme={null}
stackkit identity workload-peer enroll [flags]
```

| Flag                 | Type   | Default | Description                                                                     |
| -------------------- | ------ | ------- | ------------------------------------------------------------------------------- |
| `--address`          | string | —       | Existing federation loopback socket for the Cloud probe                         |
| `--file`             | string | —       | Public request or credential JSON file                                          |
| `--home-root-sha256` | string | —       | Home root sha256 fingerprint verified through a separate owner-approved channel |
| `--owner-approve`    | bool   | —       | Explicitly approve this local workload identity operation                       |
| `--peer-ref`         | string | —       | Explicit workload peer identity                                                 |
| `--replace-key`      | bool   | —       | Explicitly replace the selected peer key; revoked keys remain denied            |
| `--server-name`      | string | —       | Installed Home origin server name                                               |

### stackkit identity workload-peer install

Install a Home-issued certificate using an independently verified root.

```bash theme={null}
stackkit identity workload-peer install [flags]
```

| Flag                 | Type   | Default | Description                                                                     |
| -------------------- | ------ | ------- | ------------------------------------------------------------------------------- |
| `--address`          | string | —       | Existing federation loopback socket for the Cloud probe                         |
| `--file`             | string | —       | Public request or credential JSON file                                          |
| `--home-root-sha256` | string | —       | Home root sha256 fingerprint verified through a separate owner-approved channel |
| `--owner-approve`    | bool   | —       | Explicitly approve this local workload identity operation                       |
| `--peer-ref`         | string | —       | Explicit workload peer identity                                                 |
| `--server-name`      | string | —       | Installed Home origin server name                                               |

### stackkit identity workload-peer probe

Request the origin through an existing federation loopback socket.

```bash theme={null}
stackkit identity workload-peer probe [flags]
```

| Flag                 | Type   | Default | Description                                                                     |
| -------------------- | ------ | ------- | ------------------------------------------------------------------------------- |
| `--address`          | string | —       | Existing federation loopback socket for the Cloud probe                         |
| `--file`             | string | —       | Public request or credential JSON file                                          |
| `--home-root-sha256` | string | —       | Home root sha256 fingerprint verified through a separate owner-approved channel |
| `--owner-approve`    | bool   | —       | Explicitly approve this local workload identity operation                       |
| `--peer-ref`         | string | —       | Explicit workload peer identity                                                 |
| `--server-name`      | string | —       | Installed Home origin server name                                               |

### stackkit identity workload-peer request

Create or reuse a Cloud-held key and export its public CSR.

```bash theme={null}
stackkit identity workload-peer request [flags]
```

| Flag                 | Type   | Default | Description                                                                     |
| -------------------- | ------ | ------- | ------------------------------------------------------------------------------- |
| `--address`          | string | —       | Existing federation loopback socket for the Cloud probe                         |
| `--file`             | string | —       | Public request or credential JSON file                                          |
| `--home-root-sha256` | string | —       | Home root sha256 fingerprint verified through a separate owner-approved channel |
| `--owner-approve`    | bool   | —       | Explicitly approve this local workload identity operation                       |
| `--peer-ref`         | string | —       | Explicit workload peer identity                                                 |
| `--rotate-key`       | bool   | —       | Generate a new Cloud key while preserving the active credential until install   |
| `--server-name`      | string | —       | Installed Home origin server name                                               |

### stackkit identity workload-peer revoke

Withdraw a peer's current Home admission.

```bash theme={null}
stackkit identity workload-peer revoke [flags]
```

| Flag                 | Type   | Default | Description                                                                     |
| -------------------- | ------ | ------- | ------------------------------------------------------------------------------- |
| `--address`          | string | —       | Existing federation loopback socket for the Cloud probe                         |
| `--file`             | string | —       | Public request or credential JSON file                                          |
| `--home-root-sha256` | string | —       | Home root sha256 fingerprint verified through a separate owner-approved channel |
| `--owner-approve`    | bool   | —       | Explicitly approve this local workload identity operation                       |
| `--peer-ref`         | string | —       | Explicit workload peer identity                                                 |
| `--server-name`      | string | —       | Installed Home origin server name                                               |