astrid-runtime/astrid · error

redeem requires either --public-key <hex> or --keypair <name

Error message

redeem requires either --public-key <hex> or --keypair <name>. Generate one with `astrid keypair generate`.

What it means

`astrid invite redeem` needs the recipient's ed25519 public key, supplied either inline via --public-key <hex> or by naming a stored keypair via --keypair <name>. If both are omitted the command cannot construct the redeem request and bails with this message, which also points the user at `astrid keypair generate` to create a keypair first.

Source

Thrown at crates/astrid-cli/src/commands/invite.rs:152

            }
            Ok(ExitCode::SUCCESS)
        },
        other => anyhow::bail!("unexpected response shape: {other:?}"),
    }
}

async fn run_redeem(args: RedeemArgs) -> Result<ExitCode> {
    // Resolve the public key source: either an explicit `--public-key`
    // hex string or a local `--keypair` reference. Exactly one is
    // required (clap enforces mutual exclusion; this enforces presence).
    let (public_key_hex, keypair_name) = match (args.public_key, args.keypair) {
        (Some(hex), None) => (hex, None),
        (None, Some(name)) => {
            let hex = crate::commands::keypair::load_public_key_hex(&name)
                .with_context(|| format!("load public key for --keypair {name:?}"))?;
            (hex, Some(name))
        },
        (None, None) => anyhow::bail!(
            "redeem requires either --public-key <hex> or --keypair <name>. \
             Generate one with `astrid keypair generate`."
        ),
        (Some(_), Some(_)) => unreachable!("clap conflicts_with prevents this"),
    };

    // Redemption is intentionally unauthenticated kernel-side — the
    // token IS the auth. A fresh-machine redeemer typically has no
    // `cli-context.toml` yet, so don't require an active-agent context
    // here; stamp the IPC message as `default` and let the kernel's
    // `InviteRedeem` dispatch path verify the token internally.
    let mut client = connect_for_workspace_as(PrincipalId::default())
        .await
        .context("connect to daemon for invite redeem")?;
    let resp = client
        .request(AdminRequestKind::InviteRedeem {
            token: args.token,
            public_key: public_key_hex,

View on GitHub (pinned to affd8760f4)

Solutions

1. Re-run with --public-key <64-char hex> supplying the recipient public key directly.
2. Or re-run with --keypair <name> referencing an existing keypair.
3. If no keypair exists yet, run `astrid keypair generate` first, then redeem with --keypair <name>.
4. If the flag was intended, check for typos/CLI arg quoting in the invoking script.

Example fix

// before
astrid invite redeem --code <code>
// after
astrid invite redeem --code <code> --keypair default

if [ -z "$PUBKEY" ] && [ -z "$KEYPAIR" ]; then echo "need --public-key or --keypair" >&2; exit 2; fi

When it happens

Trigger: Running `astrid invite redeem` (with an invite code) but passing neither --public-key nor --keypair; e.g. forgetting the flag entirely or assuming the active agent's key is used automatically.

Common situations: First-time users redeeming an invite before generating any keypair; scripts that dropped the --keypair flag; renaming a keypair and forgetting to update the script.

Understand the failure class

Background: "Must pass :limit option" / "Missing required option" — required option errors explained — this error's family across 41 libraries.

Related errors

• keypair {name:?} already exists at {} — pass --force to over
• keypair {:?} not found
• keypair name must not be empty
• no corpus selected; omit --no-synthetic or pass a corpus or
• --capsule is required; native default env storage was retire

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/2267b87b955d4819. Report an issue: GitHub.