---
title: "oz0 server secrets-key create"
description: "Write a new secrets key: the private key that tenant secrets are sealed to with HPKE."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/server/secrets-key/create"
---
# oz0 server secrets-key create

> Write a new secrets key: the private key that tenant secrets are sealed to with HPKE.

For: Operators and developers looking up a command.

Write a new secrets key: the private key that tenant secrets are sealed to with HPKE. Give the file to every server that runs the edge role with --secrets-key-file, and to no server that runs only management. The first edge that starts with it publishes its public half; management then seals every new secret to it, and the edges seal the existing ones to it, so that management can store tenant secrets but not open them.

Keep a copy with the master key: losing it loses every secret sealed to it. With --command the new key is wrapped by that key command before it is written, so it is never on disk in the clear.

## Usage

```bash
oz0 server secrets-key create [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --command
      </code>
    </td>
    
    <td>
      command
    </td>
    
    <td>
      
    </td>
    
    <td>
      a key command that wraps the new key before it is written
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --out
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the file to write; it must not exist
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.