`source`

Sources are reusable import connections stored in your config file. Once saved, reference one with realm import --source-ref <name> instead of repeating its URL and credentials. See Import for how they’re consumed.

ferris-ctl source <subcommand>

These subcommands only read and write the config file. They make no network call. They honor -o.

`source list`

List configured sources.

ferris-ctl source list

Table columns: NAME, KIND, URL, SECRET (yes when a secret or token is stored). The JSON and YAML forms carry has_secret instead of the secret itself; the secrets are never printed.

`source add`

Add a source. Adding a name that already exists overwrites it without asking.

ferris-ctl source add <name> --kind <kind> --url <url> [auth flags]

Argument	Required	Description
`<name>`	yes	Source name
`--kind`	yes	`keycloak`, `zitadel`, or `supabase`. A config file is not a storable source: it is a path, passed with `--file` at import time
`--url`	yes	Base URL of the source instance
`--realm`	no	Keycloak: the realm to read. Supabase, and Zitadel with a pinned organization: the name of the realm to create in FerrisKey, used when the import gives no `--target-realm` or `--source-realm`
`--client-id`	no	Client id for source auth (Keycloak)
`--client-secret`	no	Client secret for source auth (Keycloak)
`--token`	no	Bearer token (a Zitadel personal access token, a Supabase `service_role` key, or a ready Keycloak token)
`--org-id`	no	Organization id (Zitadel); omit to import all orgs

ferris-ctl source add keycloak-prod \
  --kind keycloak \
  --url https://keycloak.example.com \
  --realm acme \
  --client-id ferriskey-import \
  --client-secret "$KC_SECRET"

ferris-ctl realm import --source-ref keycloak-prod --target-realm acme

A stored source holds the connection only. The Supabase options (--source-passwords, --source-preserve-ids, and the --source-include-* flags) are not stored; pass them on each import. The supabase kind exists only in builds newer than 0.3.0, see From Supabase.

Secrets are stored in plain text

Source secrets and tokens are written to config.toml without redaction, and the file is created with your default umask, usually readable by other users on the machine. Restrict the directory with chmod 700 ~/.config/ferriskey (a chmod on the file alone is lost when the CLI next saves it), and prefer short-lived tokens where possible.

`source remove`

Remove a stored source.

ferris-ctl source remove <name>

Argument	Required	Description
`<name>`	yes	Source name