stackkit user

Invite and manage household users in local PocketID. Create, list, and remove Homelab users in the PocketID household group. Add prints a one-time passkey setup URL. TinyAuth continues to admit the owners, admins, and household groups already bound on the OIDC client. Owner and admin identities cannot be created or removed here.

stackkit user [flags]

Flag	Type	Default	Description
`--json`	bool	—	Emit stackkit.command-result/v1 JSON

Examples

# Invite a household member; share the printed one-time URL only with them
stackkit user add alex --email alex@example.com --owner-approve

# List household users
stackkit user list

# Remove a household user
stackkit user remove alex --owner-approve

Subcommands: stackkit user activate, stackkit user add, stackkit user apps, stackkit user files, stackkit user list, stackkit user owner, stackkit user remove

stackkit user activate

Reissue passkey enrollment for an existing household member.

stackkit user activate <username> [flags]

Flag	Type	Default	Description
`--owner-approve`	bool	—	Explicitly approve reissuing household passkey enrollment

Inherited from stackkit user:

Flag	Type	Default	Description
`--json`	bool	—	Emit stackkit.command-result/v1 JSON

stackkit user add

Invite a household user with a one-time passkey setup URL.

stackkit user add <username> [flags]

Flag	Type	Default	Description
`--app`	stringArray	—	Node app this member may sign into (repeatable); without it the member can use every app
`--display-name`	string	—	Optional display name
`--email`	string	—	Required. Household member email
`--owner-approve`	bool	—	Explicitly approve creating this household user

Inherited from stackkit user:

Flag	Type	Default	Description
`--json`	bool	—	Emit stackkit.command-result/v1 JSON

Examples

# Invite a household member and print their one-time passkey setup URL
stackkit user add alex --email alex@example.com --owner-approve

# Set a display name and return the invitation as JSON
stackkit user add sam --email sam@example.com --display-name "Sam Doe" --owner-approve --json

stackkit user apps

Set which node apps a household user may sign into.

stackkit user apps <username> [flags]

Flag	Type	Default	Description
`--all`	bool	—	Allow every app
`--app`	stringArray	—	App the member may sign into (repeatable)
`--none`	bool	—	Allow no app
`--owner-approve`	bool	—	Explicitly approve changing this member’s apps

Inherited from stackkit user:

Flag	Type	Default	Description
`--json`	bool	—	Emit stackkit.command-result/v1 JSON

Examples

# Allow Photos and Files only
stackkit user apps alex --app photos --app files --owner-approve

# Allow every app again
stackkit user apps alex --all --owner-approve

stackkit user files

Resume and hand off app-local Files household accounts. Cloudreve CE keeps an app-local account behind TinyAuth. These commands converge that account from an approved PocketID household identity and reveal its owner-custodied password only on explicit request.

stackkit user files [flags]

Inherited from stackkit user:

Flag	Type	Default	Description
`--json`	bool	—	Emit stackkit.command-result/v1 JSON

Subcommands: stackkit user files credential, stackkit user files ensure

stackkit user files credential

Print one owner-custodied Files household password. Verify the approved PocketID household identity and its non-admin Cloudreve account, then print the existing password from signed local-owner custody. Output contains secret material; use it only in a private terminal or intentional pipe.

stackkit user files credential <username> [flags]

Flag	Type	Default	Description
`--owner-approve`	bool	—	Explicitly approve revealing this Files password

Inherited from stackkit user:

Flag	Type	Default	Description
`--json`	bool	—	Emit stackkit.command-result/v1 JSON

stackkit user files ensure

Create or verify one non-admin Files account.

stackkit user files ensure <username> [flags]

Flag	Type	Default	Description
`--owner-approve`	bool	—	Explicitly approve Files account provisioning

Inherited from stackkit user:

Flag	Type	Default	Description
`--json`	bool	—	Emit stackkit.command-result/v1 JSON

stackkit user list

List household users in local PocketID.

stackkit user list [flags]

Inherited from stackkit user:

Flag	Type	Default	Description
`--json`	bool	—	Emit stackkit.command-result/v1 JSON

Examples

# List household users
stackkit user list

# The same list as JSON
stackkit user list --json

stackkit user owner

Inspect and resume the PocketID owner passkey activation.

stackkit user owner [flags]

Inherited from stackkit user:

Flag	Type	Default	Description
`--json`	bool	—	Emit stackkit.command-result/v1 JSON

Subcommands: stackkit user owner activate, stackkit user owner migrate-domain, stackkit user owner reconcile, stackkit user owner status

stackkit user owner activate

Reissue the owner-bound one-time passkey activation link and retire the previous one.

stackkit user owner activate [flags]

Flag	Type	Default	Description
`--owner-approve`	bool	—	Explicitly approve reissuing the owner activation link

Inherited from stackkit user:

Flag	Type	Default	Description
`--json`	bool	—	Emit stackkit.command-result/v1 JSON

stackkit user owner migrate-domain

Prepare the owner-approved home to lab.home identity migration. Preserve the existing owner, CA, service secrets and users while migrating Basement intent and runtime custody from home to lab.home. Preserve the prior-release CLI, packaged tools and provider mirror before using an isolated target CLI for this command. --quiesce-runtime authorizes the command to capture the exact source Core container identities, converge the identity callback while PocketID is available, then gracefully stop and remove only those containers without deleting volumes, networks or images. Use the prior CLI for generate, apply and verify, then use the target CLI for upgrade --to <exact-release>. The upgrade checkpoint covers the migrated prior release on lab.home; this command creates no original-domain rollback checkpoint. The v0.47.4 bridge awaits real-host qualification. After rollout, enroll client DNS and new passkeys at id.lab.home.

stackkit user owner migrate-domain [flags]

Flag	Type	Default	Description
`--owner-approve`	bool	—	Explicitly approve domain migration and new passkey enrollment
`--quiesce-runtime`	bool	—	Gracefully stop and remove the authenticated source Core containers without deleting persistent resources
`--spec`	string	`stack-spec.yaml`	Workspace-relative StackSpec to migrate

Inherited from stackkit user:

Flag	Type	Default	Description
`--json`	bool	—	Emit stackkit.command-result/v1 JSON

stackkit user owner reconcile

Enable legacy TinyAuth PKCE only against the verified existing Owner binding. Requires explicit Owner approval and an idle native lifecycle. Verifies every existing Owner, client, callback and group binding before enabling PKCE, then verifies again. Keeps Owner keys, users, groups, client secret, enrollment links, Plan and release pin. Other identity drift fails closed. On a managed server invoke through authorized Techstack server access; this performs no Advanced apply or provider execution.

stackkit user owner reconcile [flags]

Flag	Type	Default	Description
`--owner-approve`	bool	—	Explicitly approve PKCE-only convergence of the existing verified identity binding

Inherited from stackkit user:

Flag	Type	Default	Description
`--json`	bool	—	Emit stackkit.command-result/v1 JSON

stackkit user owner status

Read the owner passkey activation status.

stackkit user owner status [flags]

Inherited from stackkit user:

Flag	Type	Default	Description
`--json`	bool	—	Emit stackkit.command-result/v1 JSON

stackkit user remove

Remove a household user from local PocketID.

stackkit user remove <username> [flags]

Flag	Type	Default	Description
`--owner-approve`	bool	—	Explicitly approve removing this household user

Inherited from stackkit user:

Flag	Type	Default	Description
`--json`	bool	—	Emit stackkit.command-result/v1 JSON

Examples

# Remove a household user
stackkit user remove alex --owner-approve

Get started

Get help

Guides

Reference

stackkit user activate

stackkit user add

stackkit user apps

stackkit user files

stackkit user files credential

stackkit user files ensure

stackkit user list

stackkit user owner

stackkit user owner activate

stackkit user owner migrate-domain

stackkit user owner reconcile

stackkit user owner status

stackkit user remove

​stackkit user activate

​stackkit user add

​stackkit user apps

​stackkit user files

​stackkit user files credential

​stackkit user files ensure

​stackkit user list

​stackkit user owner

​stackkit user owner activate

​stackkit user owner migrate-domain

​stackkit user owner reconcile

​stackkit user owner status

​stackkit user remove

stackkit user activate

stackkit user add

stackkit user apps

stackkit user files

stackkit user files credential

stackkit user files ensure

stackkit user list

stackkit user owner

stackkit user owner activate

stackkit user owner migrate-domain

stackkit user owner reconcile

stackkit user owner status

stackkit user remove