lettuce keys
lettuce keys
Manage Lettuce API keys (agent tokens) from the command line.
lettuce keys <subcommand>
Subcommands
| Subcommand | What it does |
|---|---|
list |
List all issued keys |
add |
Issue a new key |
remove |
Remove a key by label |
lettuce keys list
lettuce keys list
Lists every key Lettuce has issued, with its label, scope, and any folder allowlist.
lettuce keys add
lettuce keys add --label "Claude Code" --scope write
Flags:
| Flag | Default | Notes |
|---|---|---|
--label NAME |
(required) | Human-readable name for the key |
--scope |
all |
One of read, write, all |
--allow LIST |
(none) | Comma-separated folder allowlist, e.g. Inbox,Areas/Work |
--propose |
(off) | Make this a write-scoped key that queues proposals instead of writing directly |
--scope accepts exactly three values: read, write, or all. There is no propose scope — proposing is the separate --propose flag, which produces a write-scoped key whose changes are queued as proposals for review.
--allow is the only scoping beyond read/write/all: it restricts the key to one or more folders. Pass a comma-separated list of folder paths.
The secret is printed once, when the key is added. Save it then — it cannot be retrieved later.
The token is URL-safe base64 of 32 random bytes (no prefix).
Examples
A read-only key:
lettuce keys add --label "Read-only viewer" --scope read
A write key restricted to the Inbox folder:
lettuce keys add --label "Inbox capture" --scope write --allow Inbox
A key whose edits are queued as proposals rather than applied directly:
lettuce keys add --label "Tag Curator" --scope write --propose
A write key scoped to a couple of folders:
lettuce keys add --label "Work agent" --scope write --allow "Inbox,Areas/Work"
lettuce keys remove
lettuce keys remove --label "Claude Code"
Removes the key with the given label. Any subsequent request using that token is rejected.
Where keys live
Lettuce-issued agent tokens are stored in the macOS Keychain. You can browse them in Keychain Access.app — they’re tagged with descriptive names.