lettuce keys

~2 min read

lettuce keys

Manage Lettuce API keys (agent tokens) from the command line.

lettuce keys <subcommand>

Subcommands

Subcommand What it does
list List all issued keys
add Issue a new key
remove Remove a key by label

lettuce keys list

lettuce keys list

Lists every key Lettuce has issued, with its label, scope, and any folder allowlist.

lettuce keys add

lettuce keys add --label "Claude Code" --scope write

Flags:

Flag Default Notes
--label NAME (required) Human-readable name for the key
--scope all One of read, write, all
--allow LIST (none) Comma-separated folder allowlist, e.g. Inbox,Areas/Work
--propose (off) Make this a write-scoped key that queues proposals instead of writing directly

--scope accepts exactly three values: read, write, or all. There is no propose scope — proposing is the separate --propose flag, which produces a write-scoped key whose changes are queued as proposals for review.

--allow is the only scoping beyond read/write/all: it restricts the key to one or more folders. Pass a comma-separated list of folder paths.

The secret is printed once, when the key is added. Save it then — it cannot be retrieved later.

The token is URL-safe base64 of 32 random bytes (no prefix).

Examples

A read-only key:

lettuce keys add --label "Read-only viewer" --scope read

A write key restricted to the Inbox folder:

lettuce keys add --label "Inbox capture" --scope write --allow Inbox

A key whose edits are queued as proposals rather than applied directly:

lettuce keys add --label "Tag Curator" --scope write --propose

A write key scoped to a couple of folders:

lettuce keys add --label "Work agent" --scope write --allow "Inbox,Areas/Work"

lettuce keys remove

lettuce keys remove --label "Claude Code"

Removes the key with the given label. Any subsequent request using that token is rejected.

Where keys live

Lettuce-issued agent tokens are stored in the macOS Keychain. You can browse them in Keychain Access.app — they’re tagged with descriptive names.