Encrypted project environment commands
pinset env recipient remove
Remove one recipient from a profile after proving current decryption access.
View source on GitHub ↗| Field | Description |
|---|---|
| Purpose | Remove one recipient from a profile after proving current decryption access. |
| Syntax and arguments | pinset env recipient remove <age1...> --profile <name> [--cwd <path>]. |
| Modifies state | Yes. Re-encrypts and updates configuration transactionally; the original ciphertext is restored if the configuration update fails. |
| Example | pinset env recipient remove age1example... --profile production |
| JSON | No. |
| Key errors | Invalid recipient, attempt to remove the final recipient, no matching identity, or re-encryption/configuration failure. |
Adding or removing a recipient changes the trusted environment policy. Commit both pinset.toml and the new ciphertext, then run pinset trust add again on each machine and in CI. Removing a recipient prevents future decryption with that identity but cannot revoke plaintext already obtained earlier.
/en/docs/commands/env-recipient-removePinset 2.1