kylon-cli 0.2.3 → 0.2.4

package/README.md

@@ -159,21 +159,27 @@ be reached, it retains the cached IDs and reports that remote details are
 unavailable.
 
 Browser authorization includes the API origin in the saved workspace profile,
-so workspace commands do not require `--server-url` again. Canonical secrets
-are workspace resources with explicit agent grants:
+so workspace commands do not require `--server-url` again. API keys are
+write-only Connections with explicit agent grants. Create one by asking the
+workspace's Kylon agent to start the secure Connection setup flow;
+enter the Connection name, key, value, and optional icon in the app. The
+workspace CLI can list granted key names and inject them into one child command:
 
 ```bash
 kylon workspace secret list --scope-workspace <WORKSPACE_ID>
-echo "my-secret" | kylon workspace secret set MY_KEY --value-stdin \
-  --scope-workspace <WORKSPACE_ID>
+kylon workspace secret run -- curl https://api.example.com/resource
 ```
 
+`kylon workspace secret set` is retired. It accepts no secret value and only
+prints guidance for the secure Connection flow.
+
 There is intentionally no top-level `kylon secret` command. The namespace
 selects the resource and identity without inspecting unrelated local credential
 state:
 
-- Use `kylon workspace secret list|set|delete` for canonical workspace secrets
-  with browser authorization.
+- Use `kylon workspace secret list|share|unshare|delete|run` for canonical
+  workspace secret grants with browser authorization. Create API keys through
+  the secure Connection flow in Kylon.
 - Use `kylon gateway secret list|set|delete --agent <agent-id>` for agent-local
   records, authenticated by this machine's computer credential through the
   per-agent computer routes.