Admin Commands

Commands for runtime configuration, branding, signing key management, and instance introspection.

All commands require a running server and admin credentials:

export SHARK_ADMIN_TOKEN=$(cat admin.key.firstboot)
export SHARK_URL=http://localhost:8080

shark admin config dump

Fetch and pretty-print the live admin configuration from the running server.

Synopsis

shark admin config dump [flags]

Flags

The command always emits indented JSON — config is inherently structured and has no useful human-readable representation.

Examples

shark admin config dump

# Pipe to jq for specific fields
shark admin config dump | jq .server

shark admin config dump | jq '.email.host'

# Save snapshot before a change
shark admin config dump > config-snapshot-$(date +%Y%m%d).json

Gotchas

• Config is DB-backed (yaml was removed in W17). Changes made via the dashboard or API are reflected immediately.
• Sensitive fields (secrets, SMTP passwords) are redacted in the API response.

shark auth config show

Show the current server configuration. Alias of shark admin config dump — both commands fetch the full live config via GET /api/v1/admin/config.

Synopsis

shark auth config show [flags]

Flags

Examples

shark auth config show

shark auth config show --json | jq .

shark branding get

Read current branding design tokens for an app.

Synopsis

shark branding get <slug> [flags]

Arguments

Flags

Examples

# Read current tokens
shark branding get my-app

# Pipe to jq
shark branding get my-app | jq .design_tokens

shark branding set

Set design tokens for an app. Accepts key=value pairs or a JSON file.

Synopsis

shark branding set <slug> [flags]

Arguments

Flags

Exactly one of --token or --from-file must be provided.

Examples

# Set individual tokens
shark branding set my-app \
  --token colors.primary=#6366f1 \
  --token typography.font_family=Inter

# Multiple tokens
shark branding set my-app \
  --token colors.primary=#6366f1 \
  --token colors.secondary=#8b5cf6 \
  --token radius.button=8px

# From a JSON file
shark branding set my-app --from-file tokens.json

# Example tokens.json
cat tokens.json
# {
#   "colors.primary": "#6366f1",
#   "typography.font_family": "Inter",
#   "radius.button": "8px"
# }

# JSON response
shark branding set my-app --token colors.primary=#6366f1 --json

Gotchas

• Token keys are dot-notation paths (e.g. colors.primary, typography.font_family). The format is defined by the dashboard's design token system.
• Changes take effect immediately — no server restart required.

shark keys generate-jwt

Rotate the active RS256 JWT signing keypair via the admin API.

Synopsis

shark keys generate-jwt [flags]

Flags

Examples

# Rotate signing key
shark keys generate-jwt

# Machine-readable
shark keys generate-jwt --json | jq .kid

# With compatibility flag
shark keys generate-jwt --rotate

Gotchas

• The old key is retired (not deleted). Both old and new keys remain in the JWKS endpoint until rotated_at + 2 × access_token_ttl has elapsed, ensuring in-flight tokens remain valid.
• shark doctor warns if any active key is older than 90 days.
• Rotating mid-traffic is safe — the JWKS endpoint serves all non-expired keys.

shark whoami

Introspect the current token and print identity information.

Synopsis

shark whoami [flags]

Flags

Behavior

1. Calls GET /api/v1/auth/me with the configured token as a Bearer.
2. If that returns 401 (e.g. the token is an admin API key, not a user JWT), falls back to GET /api/v1/admin/stats to verify the key is valid.
3. Reports token_type: admin_api_key in that case.

Examples

# Check current token
shark whoami

# Verify admin key
export SHARK_ADMIN_TOKEN=$(cat admin.key.firstboot)
shark whoami

# Machine-readable
shark whoami --json | jq '{id, email}'

# Check a specific token
shark whoami --token eyJhbGci... --json

shark health

Ping the /healthz endpoint. Documented in full in 01-server.md.

shark cli

Print a grouped summary of all shark CLI commands to stdout.

Synopsis

shark cli

No flags. Useful for a quick reference when offline.

Examples

shark cli

Deprecated / Removed Commands