The seam is MIT and is gated by nothing. You can generate your own keypair, register the public half, and write your own management client against the same contract the hosted dashboard uses.
pithy dashboard connect --env prod \
--public-key ./client.jwk.json \
--issuer https://admin.example.com \
--scope manifest:readNo dashboard is contacted. No browser opens.
--issuer is required here, and refused elsewhere
Connecting an environment is the ordinary path this one replaces; writing your own management client is why you would; rotating and revoking is yours to drive afterwards.
The issuer is the exact origin every token from this connection must carry, and it is compared on every call — so there is no default to fall back on.
On the browser path the client mints the keypair and returns its own issuer, so passing the flag there would be a value nothing reads. It is refused rather than ignored, and so is a key id off that path.
The status is registered, not connected
Nothing proves the key. The CLI holds no private half to sign with, so it cannot round-trip a ping the way the browser path does — and the command says so rather than claiming a verification it did not perform.
Prove it yourself once your client can sign:
pithy dashboard status --env prod --verifyWhat the key has to be
An Ed25519 public JWK. Four things are refused rather than written into your authorization row:
| Refused | Why |
|---|---|
| A file that is not JSON | — |
| A key of another curve | The seam verifies Ed25519 signatures |
| A private key, carrying its private component | You are registering the public half. A private key in a file you are about to hand to a CLI is a mistake worth catching |
| A key with no id | Every token names its key in a header, and a key nobody can address is a key nobody can use |
Supply the id with --key-id if your JWK does not carry one.
Writing the client
The contract is a module you can import rather than a specification you transcribe. It carries the calls, the response shapes and the hosted origin — and it reaches for no timer, no network primitive and nothing platform-specific, so it compiles in a Worker as readily as in a build script.
Implement the interface and let the compiler tell you what you owe, rather than copying field sets into a test that can drift.
Every call your client makes is the same shape the dashboard’s are: a short-lived, single-scope token, bound to a digest of its own body, checked for replay. Your Worker does not distinguish the two and has no reason to.
Rotating without a dashboard
The rotation calls are yours to make, in the same order and for the same reason: append, prove, then expire.
Append a successor signed with the current key. Prove it with a real call signed by the new one. Expire the old one — in a call signed with the successor, because naming a live key is not proof that you can sign with it.
connect --public-key registers a first key and refuses a successor while one is live, naming that call. It has no private half to sign with, and doing it for you would take the registration out of your own audit trail.
When you would do this
An internal admin tool that reads production without keeping a second copy of production.
A script that pulls a report on a schedule.
A dashboard you would rather run yourself, for a reason of your own.
None of those is a lesser path. The hosted dashboard is one consumer of a public seam, and it holds no capability yours cannot.