Tinkey is Tink's command line utility for managing keys. Tinkey lets you encrypt
or decrypt keysets with key encryption keys stored in a remote KMS. Tinkey has
built-in support for AWS KMS and Google Cloud KMS.

> [!NOTE]
> **Note:** Tinkey requires Java 11 or later to run.

## Installation

You can install Tinkey from prebuilt binaries, use Homebrew, or build Tinkey
from the Tink source:

### Prebuilt binaries

The latest release of Tinkey is 1.14.0
([download](https://storage.googleapis.com/tinkey/tinkey-1.14.0.tar.gz)). It works on Linux, macOS, and Windows.

### Homebrew

To install Tinkey with [Homebrew](https://brew.sh/), run the following
command:

    brew tap tink-crypto/tink-tinkey https://github.com/tink-crypto/tink-tinkey
    brew install tinkey

### From source

To build the latest version of Tinkey from Tink's source code, use
[Bazel](https://bazel.build) with
[Bazelisk](https://github.com/bazelbuild/bazelisk):

     TINKEY_URL="https://github.com/tink-crypto/tink-tinkey/archive/refs/tags/v1.14.0.zip"
     TINKEY_SHA256="0ef4cd6a01e4b500c33a782dc34eb29858d0e0399022fa9e94b4ad0837190dc1"
     curl -LsS "${TINKEY_URL}" -o tinkey.zip
     echo "${TINKEY_SHA256} tinkey.zip" | sha256sum -c
     unzip tinkey.zip && cd "tink-tinkey-1.14.0"
     bazelisk build //:tinkey

This produces the binary `bazel-bin/tinkey`.

## Command reference

Tinkey can be used to generate keys and do other management tasks like
encrypting, decrypting, or rotating keys.

The syntax for using the commands listed in the table is `tinkey <command>
[<args>]`.

> [!NOTE]
> **Note:** For information about the arguments available or required for a command, run `tinkey <command>` without further arguments.

| Command | Action |
|---|---|
| `help` | Prints a help message for all available commands. |
| `add-key` | Generates and adds a new key to a keyset. |
| `convert-keyset` | Changes format, encrypts, decrypts a keyset. |
| `create-keyset` | Creates a new keyset. |
| `create-public-keyset` | Creates a public keyset from a private keyset. |
| `list-key-templates` | Lists all supported key templates. |
| `delete-key` | Deletes a specified key in a keyset. |
| `disable-key` | Disables a specified key in a keyset. |
| `enable-key` | Enables a specified key in a keyset. |
| `list-keyset` | Lists keys in a keyset. |
| `promote-key` | Promotes a specified key to primary. |
| `rotate-keyset` | *\[Deprecated\]* Adds a new key and makes it the primary. (Instead, we recommend first adding a new key with `add-key` and later explicitly making it the primary with `promote-key`. In distributed systems, one needs to make sure the newly added key is available on every server before promoting it to primary.) |