# spin sign

**Spinbox is experimental: APIs change and data may be lost.** What is built and what proves it is on [Status](https://spin-stack.github.io/website/reference/status.md); what Spinbox does not do is on [Limitations](https://spin-stack.github.io/website/overview/limitations.md).

> spin sign: Sign what only you can: your keyring and your teams' rosters.

<!-- Generated by tools/refgen from spin:cmd/cli. Edit the source, not this file. -->

```
Who logs in to a workspace is its access, which its owner signs with a key of their keyring
(the keys that sign for you), and its identity - the token it presents to a cloud, the
certificate it signs a commit with - names its team as the team's roster says (its members,
signed by its owners). The host a workspace runs on holds both to these, and the control plane
proposes each from what it holds and signs none of them: a control plane that is taken can
neither let somebody into your workspace nor put one in your team.

This shows each document waiting for your signature, and signs it with a key this machine holds
- in ~/.ssh, ~/.spin/ssh or ssh-agent, a FIDO2 key's included - once you say it is right. Your
keyring first: the rest are held to it. A key you register, or a member added to a team you
own, waits here until you sign.

Lost every key your keyring lists? --start-anew begins it again with the keys you registered
since. Your workspaces know the old keyring and not the new one: recover each into a new
workspace from its last snapshot, and ask your teams' owners to sign you in again.

Usage:
  spin sign [flags]

Flags:
  -h, --help         help for sign
      --start-anew   begin your keyring again, for when you lost every key it lists
  -y, --yes          sign without asking about each document

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```