Registry stack documentation: machine-readable Markdown.
Index of all pages: https://docs.registrystack.org/llms.txt
Full corpus: https://docs.registrystack.org/llms-full.txt

# evidencectl keygen secret command reference

> Generated syntax and options for evidencectl keygen secret.

{/* Generated from Clap command definitions by scripts/generate-cli-reference.mjs. Run npm run generate. */}

One random raw secret file, 32 bytes (audit or subject-binding HMAC).

## Contract status

This page is generated from the public Clap command tree. Hidden implementation commands are omitted.

## Description

One random raw secret file, 32 bytes (audit or subject-binding HMAC). This is HMAC key material, not a credential a source will accept: the bytes are arbitrary and an HTTP header value rejects most of them. Use `keygen token` for a bearer token.

## Usage

```text
evidencectl keygen secret --out <OUT>
```

## Options

| Option | Always required | Default | Values | Environment | Description |
| --- | --- | --- | --- | --- | --- |
| `--out <OUT>` | Yes | n/a | n/a | n/a | Output file for the raw secret (written 0600) |
| `-h, --help` | No | n/a | n/a | n/a | Print help (see a summary with '-h') |

## Generation contract

Run `npm run generate` from `docs/site` after changing a public command, argument, option, default, environment binding, or help description.