Docs · the operator CLI

signetctl.

Operate a Signet instance from the terminal: the same verbs the Admin API contract documents, plus the two the console cannot give you and the ADK in executable form. Version 0.1.0, tag signetctl-v0.1.0. This reference is generated from the tool’s own --help tree, so it cannot drift from what ships.

Two verbsThe ADKEvery verb

What it is not. signetctl is an operator tool and an agent on-ramp, not a client library. Your application still uses the stock better-auth client; there is no Signet SDK to learn, and this tool does not change that.
signetctl --help
Operate a Signet instance from the terminal — the same verbs the Admin API documents

Usage: signetctl [OPTIONS] <COMMAND>

Commands:
  stats                  Instance stats: users, active sessions, sign-ins per day, delivery and rate-limit counters
  users                  Manage users
  sessions               Manage sessions
  api-keys               Mint declared-permission API keys for users
  app-users              Manage tenant/application-scoped end-user populations
  service-principals     List and create stable tenant-owned service identities
  authorization-roles    List and define persisted D150 roles in an exact platform or organization scope
  principal-role-grants  List and grant persisted authorization roles to principals
  service-tokens         Mint credentials for existing service identities
  tokens                 Token inventory and revocation
  signing-keys           Ed25519 JWKS trust-root lifecycle (platform admin only)
  platform-credentials   Managed platform-administrator credential lifecycle (platform admin only)
  deliveries             Delivery dead-letters (undeliverable emails/webhooks)
  events                 Event dead-letters
  config                 Instance configuration
  audit                  Admin audit log
  differential-verify    Compare paired credentials at Signet and a pluggable predecessor without making either authoritative
  doctor                 Diagnose an instance end to end: alias redirects, admin surface health, route currency, delivery
  quickstart             Emit working auth wiring for a named stack
  agent                  Agent harness + REPL: your own OpenAI-compatible endpoint drives the CLI's verbs (BYO LLM; nothing leaves your perimeter)
  mcp                    Model Context Protocol surface
  help                   Print this message or the help of the given subcommand(s)

Options:
      --url <URL>              Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
      --admin-key <ADMIN_KEY>  Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
  -h, --help                   Print help
  -V, --version                Print version

Two verbs the console does not have.

signetctl doctor diagnoses an instance end to end, including the four failures that present as something else: an instance URL that is a redirecting alias, a build too old for a route the caller wants, an admin surface that is unmounted rather than rejecting the key, and delivery that is configured but dead.

signetctl quickstart <curl|node|next|python> emits working auth wiring for a named stack, from the tool rather than from prose.

The ADK, executable.

signetctl agent runs the agent harness against your own OpenAI-compatible endpoint: a TUI REPL on a terminal, headless with -p, and --output-format stream-json so Claude Code or any harness can drive it as a subprocess. There is no default LLM and no telemetry; the loop talks only to your instance and your endpoint, so it runs where the engine runs, including air-gapped. signetctl mcp serve exposes the same verbs as a stateless MCP server (2026-07-28 revision) with durable tasks that survive a client restart.

Every verb.

signetctl doctor
Diagnose an instance end to end: alias redirects, admin surface health, route currency, delivery

Usage: signetctl doctor [OPTIONS]

Options:
      --url <URL>              Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
      --admin-key <ADMIN_KEY>  Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
  -h, --help                   Print help
signetctl quickstart
Emit working auth wiring for a named stack

Usage: signetctl quickstart [OPTIONS] <STACK>

Arguments:
  <STACK>  Target stack [possible values: curl, node, next, python]

Options:
      --url <URL>              Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
      --admin-key <ADMIN_KEY>  Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
  -h, --help                   Print help
signetctl agent
The ADK on-ramp in executable form: an agent loop where every tool is a signetctl subcommand and every action is a recorded command. Interactive TUI REPL on a terminal; headless with -p/--output-format text|json|stream-json so other harnesses (Claude Code, CI) can drive it. BYO OpenAI-compatible endpoint — there is no default LLM and no telemetry.

Usage: signetctl agent [OPTIONS] [PROMPT]

Arguments:
  [PROMPT]
          What you want done, e.g. "create a user and show their sessions"

Options:
      --endpoint <ENDPOINT>
          OpenAI-compatible endpoint base, e.g. http://localhost:11434/v1 — yours, not ours
          
          [env: SIGNET_AGENT_ENDPOINT=]

      --url <URL>
          Instance origin, e.g. https://auth.example.com (canonical host, not an alias)
          
          [env: SIGNET_URL=]

      --admin-key <ADMIN_KEY>
          Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input

      --model <MODEL>
          Model name at that endpoint, e.g. deepseek-v4-flash:0731-cloud
          
          [env: SIGNET_AGENT_MODEL=]

      --api-key <API_KEY>
          API key for that endpoint, if it needs one
          
          [env: SIGNET_AGENT_API_KEY]

  -p, --print
          Headless: run the prompt, print, exit (never opens the REPL)

      --output-format <OUTPUT_FORMAT>
          Output format for headless runs
          
          [default: text]
          [possible values: text, json, stream-json]

      --list-tools
          Print the derived tool list (one per CLI verb) and exit

      --max-turns <MAX_TURNS>
          Maximum model turns before stopping
          
          [default: 25]

  -h, --help
          Print help (see a summary with '-h')
signetctl mcp
Model Context Protocol surface

Usage: signetctl mcp [OPTIONS] <COMMAND>

Commands:
  serve  Serve the command tree as a stateless MCP server on stdio
  help   Print this message or the help of the given subcommand(s)

Options:
      --url <URL>              Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
      --admin-key <ADMIN_KEY>  Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
  -h, --help                   Print help
signetctl stats
Instance stats: users, active sessions, sign-ins per day, delivery and rate-limit counters

Usage: signetctl stats [OPTIONS]

Options:
      --url <URL>              Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
      --admin-key <ADMIN_KEY>  Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
  -h, --help                   Print help
signetctl users
Manage users

Usage: signetctl users [OPTIONS] <COMMAND>

Commands:
  list        List users, newest first, with substring search over email and name
  create      Create a user
  set-role    Set a user's role or roles
  delete      IRREVERSIBLE: delete a user and every row they own
  ban         Ban a user (reversible) — revokes their sessions and user-backed credentials
  unban       Lift a user's ban
  unlock      Clear a lockout/escalation state, addressed by email
  sessions    List a user's sessions
  revoke-all  Revoke every session belonging to a user
  help        Print this message or the help of the given subcommand(s)

Options:
      --url <URL>              Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
      --admin-key <ADMIN_KEY>  Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
  -h, --help                   Print help
signetctl sessions
Manage sessions

Usage: signetctl sessions [OPTIONS] <COMMAND>

Commands:
  revoke  Revoke one session by its at-rest token reference (as listed by `users sessions`)
  help    Print this message or the help of the given subcommand(s)

Options:
      --url <URL>              Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
      --admin-key <ADMIN_KEY>  Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
  -h, --help                   Print help
signetctl tokens
Token inventory and revocation

Usage: signetctl tokens [OPTIONS] <COMMAND>

Commands:
  list              List the token inventory, keyset-paged (use --cursor, not offset)
  config            Show the token-kind registry
  get               Show one token record by handle
  revoke            Revoke one token
  revoke-principal  Review or atomically revoke one service principal's exact active credential estate
  help              Print this message or the help of the given subcommand(s)

Options:
      --url <URL>              Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
      --admin-key <ADMIN_KEY>  Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
  -h, --help                   Print help
signetctl deliveries
Delivery dead-letters (undeliverable emails/webhooks)

Usage: signetctl deliveries [OPTIONS] <COMMAND>

Commands:
  dead-letters  List delivery dead-letters
  replay        Replay one dead-lettered delivery
  help          Print this message or the help of the given subcommand(s)

Options:
      --url <URL>              Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
      --admin-key <ADMIN_KEY>  Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
  -h, --help                   Print help
signetctl events
Event dead-letters

Usage: signetctl events [OPTIONS] <COMMAND>

Commands:
  dead-letters  List event dead-letters
  replay        Replay one dead-lettered event
  help          Print this message or the help of the given subcommand(s)

Options:
      --url <URL>              Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
      --admin-key <ADMIN_KEY>  Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
  -h, --help                   Print help
signetctl config
Instance configuration

Usage: signetctl config [OPTIONS] <COMMAND>

Commands:
  show  Show the instance's effective configuration (secrets absent by construction)
  help  Print this message or the help of the given subcommand(s)

Options:
      --url <URL>              Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
      --admin-key <ADMIN_KEY>  Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
  -h, --help                   Print help
signetctl audit
Admin audit log

Usage: signetctl audit [OPTIONS] <COMMAND>

Commands:
  export  Export the complete admin audit log as NDJSON to stdout, traversing bounded keyset pages
  help    Print this message or the help of the given subcommand(s)

Options:
      --url <URL>              Instance origin, e.g. https://auth.example.com (canonical host, not an alias) [env: SIGNET_URL=]
      --admin-key <ADMIN_KEY>  Platform/scoped admin bearer for /admin/v1: commands fall back to SIGNET_ADMIN_KEY after dispatch; differential-verify rejects this input
  -h, --help                   Print help

How it arrives: signetctl ships with hosted onboarding and enterprise delivery. There is no public download, for the same reason there is no installer: a first deployment is an engagement, and the tool arrives with it.