credctl reset

Synopsis

credctl reset [flags]

Description

credctl reset tears down all cloud infrastructure created by credctl and removes the local ~/.credctl directory. This is a destructive operation intended for starting fresh or cleaning up after testing.

What it deletes

AWS:

• CloudFormation stack (credctl-infra)
• IAM role (detaches all policies first)
• IAM OIDC provider
• S3 OIDC bucket

GCP:

• Workload Identity Pool (cascades to providers and bindings)
• GCS OIDC bucket
• GCP credential config file

Local:

• ~/.credctl/ directory (config, public key, OIDC documents)

What it does NOT delete

• The Secure Enclave private key — macOS manages its lifecycle. Running credctl init after reset will create a new key pair.

Flags

Flag	Type	Default	Description
--force	bool	false	Skip the confirmation prompt.

Examples

Interactive reset

credctl reset

This will delete all credctl config and tear down cloud resources. Continue? [y/N] y
Deleting CloudFormation stack 'credctl-infra'...
Cleaning up IAM role 'credctl-device-role'...
Deleting IAM OIDC provider...
Deleting Workload Identity Pool 'credctl-pool'...
Deleting GCS bucket 'credctl-oidc-my-project'...
Removing ~/.credctl...

Reset complete.

Force reset (no prompt)

credctl reset --force

Exit codes

Code	Meaning
0	Reset completed (warnings for individual resource deletion failures are non-fatal)
1	Error (could not read config or remove local directory)

See also

• credctl init — create a new device identity after reset
• credctl setup aws — recreate AWS infrastructure
• credctl setup gcp — recreate GCP infrastructure