---
title: "oz0 server master-key unwrap-to-file"
description: "Usage and flags for oz0 server master-key unwrap-to-file."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/server/master-key/unwrap-to-file"
---
# oz0 server master-key unwrap-to-file

> Usage and flags for oz0 server master-key unwrap-to-file.

For: Operators and developers looking up a command.

The way out of a key command: unwrap the master key once more with `COMMAND unwrap` and write it as a plain key file, mode 0600, in place of the wrapped one (kept as \<file>.wrapped), or at --out, which must not exist. Servers then start without --master-key-command, so the command, and whatever holds its wrapping key, can be taken away. It needs only `COMMAND unwrap`, and no licence.

With --db-file, OZ0_DB or --dev it checks the key against the cluster and writes an audit entry.

## Usage

```bash
oz0 server master-key unwrap-to-file --command COMMAND [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --command
      </code>
    </td>
    
    <td>
      command
    </td>
    
    <td>
      
    </td>
    
    <td>
      the key command that unwraps the file
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --data-dir
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        ~/.local/share/orchestrator-zero
      </code>
    </td>
    
    <td>
      server data directory
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --db-file
      </code>
    </td>
    
    <td>
      file
    </td>
    
    <td>
      
    </td>
    
    <td>
      a file (- for stdin) holding the PostgreSQL URL of the management database, such as postgres://oz0:PASSWORD@db:5432/oz0 (or set OZ0_DB); the URL can carry a password, so it never goes on the command line
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --dev
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      a dev server's data directory (--data-dir) instead of a cluster's database
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --master-key-file
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        &lt;data-dir>/master.key
      </code>
    </td>
    
    <td>
      the master key file the servers start with
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --out
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      write the plain key file here instead of in place of the wrapped one
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.