> ## Documentation Index
> Fetch the complete documentation index at: https://delivery.vexa.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# claim.sh

> Turn a short single-use code into a Secret, without seeing the value.

Source: `kit/claim.sh` · audience: customer

## When you use this

Turn the short code someone read to you on a call into your channel credential, written straight into a Secret in your cluster. Reach for it when you are adding the credential to a cluster that is already installed, or re-adding one after a rotation; a first install takes the same code through `install.sh --claim-code` instead. The value never appears on your screen, so there is nothing to paste, nothing in your shell history and nothing to shred afterwards. `--print-once` is the exception, for the registry mirror that can only be configured by pasting a password into a form: it prints, and warns that the code is spent and the value now exists only where you put it.

## Usage

Emitted from `kit/claim.sh --help`.

```text theme={null}
usage: claim.sh --code <code> --edge <url> --station <name> \
                [--namespace <ns>] [--rotate] [--print-once]

required
  --code        the six digits read to you on the call. Written 123 456 and
                typed either way: --code 123456, or --code '123 456' in quotes
  --edge        the channel's claim endpoint, e.g. https://channel.example/claim
  --station     your station name, from your onboarding pack

writing the Secret (the normal path)
  --namespace   namespace to write the Secret into. Required unless --print-once
  --secret-name Secret to write (default: vexa-station-credential, the name the
                station bundle expects; keys username/password)
  --rotate      overwrite a Secret that already exists. Without it an existing
                Secret is a refusal, because replacing a working credential by
                accident is indistinguishable from a rotation until the next pull
  --kubeconfig  kubeconfig path (default: ambient)

the mirror path
  --print-once  print the credential to stdout instead of writing a Secret, for
                pasting into a registry mirror's endpoint configuration (Harbor,
                Artifactory, ECR) that has no way to read a Kubernetes Secret.
                It is the ONE path here that puts the value on your screen: the
                code is spent either way, so the value is now yours to keep or
                lose. Never both --print-once and --namespace

other
  --dry-run     print what would happen; contact nothing, write nothing

exit codes
  0  claimed — the credential is in the cluster (or on your screen, --print-once)
  1  THE EDGE REFUSED THIS CLAIM. Something answered and said no: the code is
     wrong, expired, already used, burned by failed attempts, or bound to
     another station. Ask for a new code
  2  usage
  3  NO CLAIM SERVICE ANSWERED AT --edge. Nothing was reached, or something
     that is not the claim service answered. Your code is untouched and still
     good — check the URL and your egress, then run this again
```