Skip to content
Weik.ioDocs
2026.2
Try Weik.io

Users, API keys, providers and mappings

Weik.io 2026.2

Create users and API keys, connect identity providers and map their claims to project grants.

On this page

People sign in to the admin UI with a password or through an identity provider, Microsoft Entra ID or any OpenID Connect provider, and the CLI and pipelines use API keys. An API key carries its own grants, written as project/role@environments, and they can’t go beyond what the key’s owner was given.

Claim mappings turn a provider’s group or role claims into grants at every sign-in, so access follows the groups you already manage. Provider and mapping records are written with their own commands and aren’t documents that weikio apply accepts.

Commands on this page#

Command What it does
weikio get users List users.
weikio user create Create a user and print their set-password link once, when the installation has a public base URL.
weikio user reset-password Issue a one-time set-password link.
weikio user reset-totp Reset a user’s authenticator app. A platform admin or break-glass account sets up a new one at their next sign-in.
weikio describe user Show one user with memberships and API keys.
weikio user set Change a user’s display name, platform admin or break-glass setting.
weikio user disable Disable a user and their API keys.
weikio user enable Enable a disabled or locked user.
weikio delete user Delete a user with their memberships and API keys.
weikio apikey create Create an API key and print it once.
weikio get apikeys List API keys.
weikio describe apikey Show an API key with its grants.
weikio apikey revoke Revoke an API key.
weikio get providers List the identity providers.
weikio provider set Create an identity provider, or replace one with exactly the values given.
weikio describe provider Show an identity provider.
weikio delete provider Delete an identity provider and its claim mappings.
weikio get mappings List claim mappings with their IDs.
weikio mapping add Create a claim mapping. Without --integrations and --apis, a grant covers the whole project.
weikio delete mapping Delete a claim mapping by its ID.

The flags every command accepts, such as --env, --project, -o and --context, are on the CLI reference page and are left out of the tables below.

weikio get users#

List users.

Terminal
weikio get users [--disabled] [--platform-admin] [--break-glass]
Argument or flag What it does
--disabled Show only disabled users.
--platform-admin Show only platform admins.
--break-glass Show only break-glass accounts.

Who can run it: a platform administrator.

API: GET /api/v1/users.

weikio user create#

Create a user and print their set-password link once, when the installation has a public base URL. The set-password link expires in 72 hours. Users who sign in through an identity provider are created at their first sign-in and need no command.

Terminal
weikio user create <email> --display-name S [--platform-admin]
Argument or flag What it does
<email> The user’s e-mail address.
--display-name <display-name> The user’s display name.
--platform-admin Make the user a platform admin.
--reason <reason> Reason for the change, stored with the audit record.

Who can run it: a platform administrator.

API: POST /api/v1/users, POST /api/v1/users/{id}/password-reset.

Also written as weikio create user.

Terminal
$ weikio user create ci@example.com --display-name "Finance CI"
You see
Target: https://hub.example
user ci@example.com created (id 01j8..., local account, password reset required)
Link valid until 2026-09-19 10:12 UTC
Set-password link (shown once): https://hub.example/login/set-password#token=****************
Terminal
$ weikio member add finance ci@example.com --role deployer --env devtest
You see
Target: https://hub.example, project finance (argument), user ci@example.com
member finance/ci@example.com created (role deployer, environments devtest, revision 4110)

weikio user reset-password#

Issue a one-time set-password link.

Terminal
weikio user reset-password <id|email>
Argument or flag What it does
<user> The user, by ID or e-mail.
--reason <reason> Reason for the change, stored with the audit record.

Who can run it: a platform administrator.

API: POST /api/v1/users/{id}/password-reset.

weikio user reset-totp#

Reset a user’s authenticator app. A platform admin or break-glass account sets up a new one at their next sign-in.

Terminal
weikio user reset-totp <id|email>
Argument or flag What it does
<user> The user, by ID or e-mail.
--reason <reason> Reason for the change, stored with the audit record.

Who can run it: a platform administrator.

API: DELETE /api/v1/users/{id}/totp.

weikio describe user#

Show one user with memberships and API keys.

Terminal
weikio describe user <id|email>
Argument or flag What it does
<user> The user, by ID or e-mail.

Who can run it: any API key for your own user, and a platform administrator for other users.

API: GET /api/v1/users/{id}, GET /api/v1/users/_emails?email=, GET /api/v1/api-keys?user=.

weikio user set#

Change a user’s display name, platform admin or break-glass setting.

Terminal
weikio user set <id|email> [--display-name S] [--platform-admin=bool] [--break-glass=bool]
Argument or flag What it does
<user> The user, by ID or e-mail.
--display-name <display-name> The user’s display name.
--platform-admin Whether the user is a platform admin.
--break-glass Whether this is a break-glass account.
--reason <reason> Reason for the change, stored with the audit record.

Who can run it: a platform administrator.

API: PUT /api/v1/users/{id}.

weikio user disable#

Disable a user and their API keys. Every API key of the user is refused from the next request, which is also how you retire a pipeline’s user.

Terminal
weikio user disable <id|email>
Argument or flag What it does
<user> The user, by ID or e-mail.
--reason <reason> Reason for the change, stored with the audit record.

Who can run it: a platform administrator.

API: PATCH /api/v1/users/{id}.

weikio user enable#

Enable a disabled or locked user.

Terminal
weikio user enable <user> [flags]
Argument or flag What it does
<user> The user, by ID or e-mail.
--reason <reason> Reason for the change, stored with the audit record.

weikio delete user#

Delete a user with their memberships and API keys.

Terminal
weikio delete user <id|email> [-y]
Argument or flag What it does
<user> The user, by ID or e-mail.
-y, --yes Don’t ask for confirmation.
--reason <reason> Reason for the change, stored with the audit record.

Who can run it: a platform administrator.

API: DELETE /api/v1/users/{id}.

weikio apikey create#

Create an API key and print it once. The key, wk_<keyId>_<secret>, is printed once as the last line. Give it to a pipeline as WEIKIO_API_KEY.

Terminal
weikio apikey create --name S [--user <id|email>] [--expires 365d] [--grant P/R[@E,...]] ... [--integrations a,b] [--apis x,y] [--platform-admin]
Argument or flag What it does
--name <name> The key’s name.
--user <user> The user who owns the key, by ID or e-mail, by default you.
--expires <expires> When the key stops working, as a duration such as 90d or a date.
--grant <grant> A grant, as project/role[@env,...], repeated for each grant.
--integrations <integrations> Integrations the grant is limited to, comma separated.
--apis <apis> APIs the grant is limited to, comma separated.
--platform-admin Make the key a platform admin.
--reason <reason> Reason for the change, stored with the audit record.

Who can run it: any API key for a key of your own, and a platform administrator for --user and --platform-admin.

API: POST /api/v1/api-keys.

Also written as weikio create apikey.

Terminal
$ weikio apikey create --name laptop-anna --expires 90d --grant finance/deployer@devtest
You see
Target: https://hub.example, user anna@example.com (caller)
api-key laptop-anna created (id 01k7xq3m8d9h2vqz4n6p5r7t2w, expires 2026-12-15, grants finance/deployer@devtest)
API key (shown once): wk_01k7xq3m8d9h2vqz4n6p5r7t2w_****************************
Terminal
$ weikio apikey create --name finance-ci-devtest --user ci@example.com --expires 365d --grant finance/deployer@devtest
You see
Target: https://hub.example, user ci@example.com (--user)
api-key finance-ci-devtest created (id 01k7xq4b2c5f8g1j3k6m9n0p4s, expires 2027-09-16, grants finance/deployer@devtest)
API key (shown once): wk_01k7xq4b2c5f8g1j3k6m9n0p4s_****************************
Terminal
$ weikio apikey create --name finance-ci-prod --user ci@example.com --grant finance/deployer@devtest,production
You see
Target: https://hub.example, user ci@example.com (--user)
error: The grant goes beyond what 'ci@example.com' was given directly: 'ci@example.com' has the role 'deployer' in project 'finance' only in environment 'devtest'. Ask for less, or have a project administrator grant it with:
         weikio member add finance ci@example.com --role deployer --env devtest,production

weikio get apikeys#

List API keys.

Terminal
weikio get apikeys [--user <id|email>] [--expired]
Argument or flag What it does
--user <user> Show only this user’s keys, by ID or e-mail.
--expired Show only expired keys.

Who can run it: any API key for your own keys, and a platform administrator for other people’s keys.

API: GET /api/v1/api-keys?user=.

Terminal
$ weikio get apikeys --user ci@example.com
You see
NAME                 ID                           OWNER            EXPIRES      LAST USED   GRANTS
finance-ci-devtest   01k7xq4b2c5f8g1j3k6m9n0p4s   ci@example.com   2027-09-16   never       finance/deployer@devtest

weikio describe apikey#

Show an API key with its grants.

Terminal
weikio describe apikey <keyId>
Argument or flag What it does
<key-id> The API key’s ID.

Who can run it: any API key for your own keys, and a platform administrator for other people’s keys.

API: GET /api/v1/api-keys/{keyId}.

weikio apikey revoke#

Revoke an API key.

Terminal
weikio apikey revoke <keyId> [-y]
Argument or flag What it does
<key-id> The API key’s ID.
-y, --yes Don’t ask for confirmation.
--reason <reason> Reason for the change, stored with the audit record.

Who can run it: any API key for your own keys, and a platform administrator for other people’s keys.

API: DELETE /api/v1/api-keys/{keyId}.

Also written as weikio delete apikey.

weikio get providers#

List the identity providers.

Terminal
weikio get providers

Who can run it: a platform administrator.

API: GET /api/v1/providers.

weikio provider set#

Create an identity provider, or replace one with exactly the values given. The client secret stays in a project secret and the provider refers to it with --client-secret-ref.

Terminal
weikio provider set <name> --kind entra --tenant TENANT|--kind oidc --authority URL --client-id ID --client-secret-ref P.NAME [--scope S ...] [--claim-path C] [--allowed-tenant T ...] [--display-name TEXT]
Argument or flag What it does
<name> The provider’s name, the last part of its redirect URI.
--kind <kind> The kind of provider: entra or oidc.
--tenant <tenant> The tenant id, or organizations or common with --allowed-tenant (kind entra).
--authority <authority> The provider’s issuer URL (kind oidc).
--client-id <client-id> The client id registered at the provider.
--client-secret-ref <client-secret-ref> The project secret with the client secret, as project.name.
--scope <scope> A scope to request, repeated for each scope.
--claim-path <claim-path> The claim this provider’s mappings read, such as groups or roles.
--allowed-tenant <allowed-tenant> A tenant id to allow, when --tenant is organizations or common, repeated for each tenant.
--display-name <display-name> The name on the sign-in button, by default the provider’s name.
--reason <reason> Reason for the change, stored with the audit record.

Who can run it: a platform administrator.

API: GET /api/v1/providers/{name}, PUT /api/v1/providers/{name}, GET /api/v1/settings/install.

weikio describe provider#

Show an identity provider.

Terminal
weikio describe provider <name>
Argument or flag What it does
<name> The identity provider.

Who can run it: a platform administrator.

API: GET /api/v1/providers/{name}, GET /api/v1/settings/install, GET /api/v1/projects/{project}/secrets.

weikio delete provider#

Delete an identity provider and its claim mappings.

Terminal
weikio delete provider <name> [-y]
Argument or flag What it does
<name> The identity provider.
-y, --yes Don’t ask for confirmation.
--reason <reason> Reason for the change, stored with the audit record.

Who can run it: a platform administrator.

API: DELETE /api/v1/providers/{name}.

weikio get mappings#

List claim mappings with their IDs.

Terminal
weikio get mappings [--provider NAME]
Argument or flag What it does
--provider <provider> Show only the mappings of this provider.

Who can run it: a platform administrator.

API: GET /api/v1/mappings?provider=.

weikio mapping add#

Create a claim mapping. Without --integrations and --apis, a grant covers the whole project. A mapping applies at every sign-in through the provider.

Terminal
weikio mapping add <provider> <claim> <value> [--grant P/R[@E,...]] ... [--integrations N,...] [--apis A,...] [--platform-admin]
Argument or flag What it does
<provider> The identity provider.
<claim> The claim, such as groups.
<value> The claim value to match.
--grant <grant> A grant, as project/role[@env,...], repeated for each grant.
--integrations <integrations> The integrations the grant covers, comma separated (with one --grant).
--apis <apis> The APIs the grant covers, comma separated (with one --grant).
--platform-admin Make matching users platform admins.
--reason <reason> Reason for the change, stored with the audit record.

Who can run it: a platform administrator.

API: POST /api/v1/mappings.

weikio delete mapping#

Delete a claim mapping by its ID.

Terminal
weikio delete mapping <id> [-y]
Argument or flag What it does
<id> The mapping’s ID. To list the mappings with their IDs, run: weikio get mappings.
-y, --yes Don’t ask for confirmation.
--reason <reason> Reason for the change, stored with the audit record.

Who can run it: a platform administrator.

API: GET /api/v1/mappings/{uid}, DELETE /api/v1/mappings/{uid}.

Exit codes#

The commands on this page exit with the codes in the exit code table: 0 on success, 1 when the hub refuses a change, 2 for a usage error, 3 when the key is missing or not allowed, 4 when something isn’t found, 5 for a conflicting change, 6 when the hub can’t be reached and 8 when a document isn’t valid.

See also#