skarbiec expiry tokens

Invocation#

skarbiec expiry tokens [--before <iso8601>]

Purpose#

See when every JSON Web Token the vault keeps runs out, so a stored token is replaced before the program using it starts failing.

Required inputs and options#

• No positional input. --before keeps the tokens whose exp is before a UTC time of the vault's stamp form; a token that states no exp is always listed. Every text field of every live item is looked at; a value of three dot-separated base64url parts whose first two encode JSON objects is read as a token.

Output and state effects#

• Prints ok, now, before, tokens (item, field, issuer from iss, issued_at from iat, expires_at from exp and expired, soonest end first, a token stating no end last), malformed (each value shaped as a token whose header or payload does not decode, or whose header names no alg, with why) and unreadable (each item that would not open, with its error). Nothing is verified — the vault holds no issuer key — and no token, subject or other claim is printed. It writes nothing. POST /v1/operator/items/token-expiry takes before the same way; Desktop's Settings → Policy shows it as Stored tokens.

Refusals#

• A positional argument exits 2 with `usage: expiry tokens [--before <iso8601>]`, and a --before of another shape with `--before <value> is not a UTC time of the form <now>`. Fails when the vault cannot be opened; an item that will not open is listed under unreadable rather than left out.

Examples#

skarbiec expiry tokens skarbiec expiry tokens --before 2026-12-01T00:00:00Z | jq -r '.tokens[] | "\(.expires_at) \(.item)"'