aether access-key

Access keys are account credentials with full access, like a login session with a lifetime you pick. For CI, prefer scoped API keys.

Creating one, or changing its lifetime, takes a dashboard login session: do it in the dashboard under Account → CLI access keys. The reason is the same one that moved API key creation there. A credential that can mint credentials outlives its own revocation, and a stolen ~/.aether/credentials.json must not be able to leave a sibling behind. The CLI keeps everything else:

aether access-key ls
aether access-key patch "Build server" --name "Build server (old)"
aether access-key rm "Build server"

The key value is shown once, at creation in the dashboard. Save it; nothing can show it again.

Subcommand	Where it works	Flags	Purpose
add <name>	Dashboard only		Refused from the CLI with 403 and code dashboard_session_required. Create the key in the dashboard and set its lifetime with Expires in (days), default 60.
patch <name>	CLI or dashboard for --name; --ttl cannot be changed from anywhere	--name, --ttl	Rename a key. A --ttl change is refused from the CLI and the dashboard has no lifetime editor; revoke the key and create a new one with the lifetime you want.
list, ls	CLI or dashboard	--format (table or json)	List your access keys.
remove, rm <name>	CLI or dashboard		Delete a key. Asks for confirmation; needs --force in non-interactive mode.

If the dashboard itself answers dashboard_session_required, your session predates credential attribution: sign out and sign in again.