# KeyCtl - deliver secret keys with manual confirmation

## Server

```
./keyctl server
```

## Client

### Admin Access

Admin access is only allowed via the Unix Domain Socket connection.

```
export KEYCTL_ENDPOINT=unix:///var/keyctl/keyctl.sock
```

```
./keyctl ls
```

### Get Secret

The API to retrieve a secret can be called from any source IP.

```
export KEYCTL_ENDPOINT=http://127.0.0.1:7070
```

```
./keyctl get -id aabbccddeeff...
```

Get secret of type `shamir` with share via environment variable:

```
export KEYCTL_SHARE=aabbccddeeff...
./keyctl get -id aabbccddeeff...
```

Get secret of type `shamir` with share via commandline flag:

```
./keyctl get -id aabbccddeeff... -share aabbccddeeff...
```

## Usage

```
./keyctl --help

./keyctl server --help
```

## URL Scheme

### HTTP

```
keyctl://127.0.0.1:7070/?id=aabbccddeeff...&share=aabbccddeeff...
```

### HTTPS

```
keyctl://127.0.0.1:7070/?id=aabbccddeeff...&share=aabbccddeeff...&tls=true
```