keryx auth migrate¶

Description¶

Moves platform credentials out of ~/.keryx/config.yaml and into ~/.keryx/accounts.yaml — a file that holds credentials and nothing else, at mode 0600.

Usage¶

keryx auth migrate [--dry-run]

Run keryx auth migrate --help for the authoritative, always-current flag set.

Why a separate file¶

Any "share my config" or "export my settings" action cannot leak a token that is not in the file being shared. On a mixed-content file, 0600 is a blunt instrument; on one that holds only credentials, it means something (spec 0042 §3.4).

New credentials already go there — keryx auth <platform>, a rotation during posting, and auth refresh all write to the accounts file. This command moves the ones written before that changed.

Only credentials move¶

The platform wiring stays exactly where it is:

$ keryx auth migrate
moved 2 credential(s)
  platforms.instagram.access_token
  platforms.tiktok.refresh_token
from /home/you/.keryx/config.yaml
to   /home/you/.keryx/accounts.yaml (mode 0600)

# config.yaml afterwards — the wiring is not secret and stays put
platforms:
    instagram:
        app_id: "12345"
    tiktok:
        client_id: aw123

Key names are reported, never values — this output gets pasted into issues.

Look before you leap¶

$ keryx auth migrate --dry-run
would move 2 credential(s)
  platforms.instagram.access_token
  platforms.tiktok.refresh_token
…
nothing was written — re-run without --dry-run to apply

Nothing moves until you ask¶

keryx doctor reports credentials still in the old location and names this command, but never acts on its own. A tool that rewrites files you own at a moment you did not choose is a tool you stop trusting with writes.

$ keryx doctor
  [!!] Credential location: 2 credential(s) still in config.yaml

Safe to defer¶

An unmigrated credential keeps working: resolution reads the accounts file first and falls back to the general config, so nothing breaks while both exist. Each one also migrates itself the next time it rotates. Running this simply finishes the job at once rather than gradually.

Ordering¶

The accounts file is written first, and the originals removed only once that succeeded. A failure between the two leaves a duplicate — recoverable — rather than a credential that exists nowhere and can only be restored by re-running the platform's OAuth flow.