Connect via serial USB (screen or PuTTY).
screen /dev/ttyACM0 115200
putty -serial /dev/ttyACM0 -sercfg 115200,8,n,1,N
Commands marked admin require login first.
| Command |
Access |
Description |
help / ? |
user |
Print available commands for current access level |
status |
user |
Show mode, build info, uptime, board ID, WiFi, NTP, key count |
test |
user |
Blink LED, activate light, open latch |
get-time |
user |
Show current RTC time and last NTP sync timestamp |
login <key_id> <totp_code> |
user |
Enable admin mode using TOTP from an admin-flagged key |
logout |
admin |
End admin session |
reboot |
admin |
Reboot device |
| Command |
Access |
Description |
set-wifi <ssid> <password> |
admin |
Save WiFi credentials, reconnect and resync NTP |
sync-ntp |
admin |
Force immediate NTP resync |
| Command |
Access |
Description |
list-keys |
admin |
List all keys: id, status, name, enabled, admin, created |
get-key <id> |
admin |
Show key details (no secret); use get-key-secret to read the seed |
get-key-secret <id> |
admin |
Show base32 secret, otpauth:// URI and ASCII QR code for enrollment |
add-key <id> <name> |
admin |
Generate random secret and save new key. Error if id exists. |
rename-key <id> <name> |
admin |
Update key label without touching the secret |
disable-key <id> |
admin |
Disable key without deleting it |
enable-key <id> |
admin |
Re-enable a disabled key |
delete-key <id> |
admin |
Permanently delete a key |
set-key-admin <id> |
admin |
Grant admin flag - key's TOTP accepted by login |
unset-key-admin <id> |
admin |
Remove admin flag from key |
| Command |
Access |
Description |
export-keys |
admin |
Dump all keys as base64-encoded binary to serial |
import-keys |
admin |
Export current keys as backup, then prompt for base64 data to import. Paste data and send an empty line to commit. Times out after 60 seconds. |
format-storage |
user* |
Erase and reinitialise storage. Only available when storage has failed to mount. Requires typing CONFIRM. Permanently deletes all keys. |
- Key IDs must be in range 0–128
- Admin session ends on
logout or USB disconnect
- Login is open (no TOTP required) when: no WiFi configured, no admin keys exist
format-storage is marked user* because it is only accessible when storage is unavailable — no admin keys can exist to authenticate againstdelete-key overwrites the record with zeros before unlinking it, so the key's current on-flash value is no longer its secret. However, littlefs is an append-only log: stale copies written by earlier add-key / rename-key / enable-key / disable-key / set-key-admin operations can linger in flash until their block is compacted and erased. Only format-storage guarantees erasure of all key material.