CLI Reference

pip install quantumlock
quantumlock --help        # `ql` is an identical short alias

Most commands accept --json for machine-readable output. Credentials come from quantumlock configure (stored in ~/.quantumlock/config.json, mode 600) or the QUANTUMLOCK_API_KEY / QUANTUMLOCK_API_URL environment variables, which take precedence.

Command tree

Top-level

Command	Purpose
`quantumlock configure`	Interactive setup: API URL + key, saved and connection-tested
`quantumlock generate`	Generate a v1 license (`--customer`, `--features`, `--days`, `--output`)
`quantumlock validate`	Validate a license key via API (`--customer`) or a license file (`--file`)
`quantumlock stats`	Usage statistics for your account
`quantumlock list-licenses`	List issued licenses (`--limit`)
`quantumlock keygen`	Generate an enterprise key from policy-controlled entropy (`--algorithm`/`--type`+`--level`, `--name`, `--entropy-source`)
`quantumlock sign`	Sign a file, producing a `.qsig` bundle (`--file`, `--output`, `--allow-dev-fallback`)
`quantumlock verify`	Verify a file against a `.qsig` bundle (`--file`, `--signature`)
`quantumlock doctor`	Local/runtime readiness checks with recommendations
`quantumlock version`	Version info
`quantumlock legal`	Company, license, and terms information

`quantumlock v2` — license artifacts

Command	Purpose
`v2 create`	Create a LicenseArtifact (`--subject`, `--days`, `--features`, `--pqc/--no-pqc`, `--api` to create server-side)
`v2 validate`	Validate an artifact file or compact string (`--require-pqc`)
`v2 revoke`	Revoke by license ID (`--reason`, `--notes`)
`v2 status`	Fetch a signed status proof for a license
`v2 keys`	Show local signing keys and their published public halves

`quantumlock keys` — enterprise key lifecycle

Command	Purpose
`keys list` / `keys show <id>`	List keys / show one record (no private material)
`keys evidence <id>`	Create or refresh the key’s evidence bundle
`keys wrap <id>`	Wrap private material under a wrapping key (`--wrapping-key-id`)
`keys revoke <id>`	Revoke (`--reason`)
`keys activate <id>`	Activate a created or suspended key
`keys rotate <id>`	Rotate; prints the replacement key (`--reason`)
`keys suspend <id>`	Suspend without destroying material (`--reason`)
`keys expire <id>`	Mark expired
`keys archive <id>`	Archive for retention (`--reason`)
`keys destroy <id>`	Destroy material — refuses without `--confirm`
`keys policy-check`	Evaluate key policy findings
`keys provenance-report`	Export the key provenance report

`quantumlock entropy` — entropy jobs

Command	Purpose
`entropy sources`	List sources (`local`, `simulator`, `qcos`, `qrng`, `hsm`, `hybrid`) with trust levels and production allowance
`entropy collect`	Collect entropy into a job (`--source`, `--bits`, `--policy`, `--backend`, `--qcos-dry-run`)
`entropy verify <job-id>`	Health tests and min-entropy estimation
`entropy condition <job-id>`	Condition entropy into a keygen seed (`--context`)

`quantumlock secrets`

Command	Purpose
`secrets scan`	Scan local config files for likely secrets — values are redacted, only fingerprints shown (`--path` repeatable)

Worked examples

Configure, generate, validate

quantumlock configure
# API URL [https://quantumlock.softquantus.com]: <enter>
# API Key: ****    -> "Connected as: you@company.com"

quantumlock generate --customer user@company.com --features premium,api --days 365 --output license.json

quantumlock validate QLOCK-... --customer user@company.com

Key lifecycle with entropy provenance

# 1. Collect entropy explicitly (default source is the local CSPRNG;
#    qcos/qrng are opt-in and carry provenance evidence)
quantumlock entropy collect --source local --bits 65536 --json

# 2. Verify its health, then generate a key from that job
quantumlock entropy verify ej_...
quantumlock keygen --type ml-dsa --level 65 --name release-signing --entropy-job ej_...

# 3. Operate the lifecycle
quantumlock keys list
quantumlock keys rotate key_... --reason scheduled
quantumlock keys evidence key_...
quantumlock keys destroy key_... --reason decommissioned --confirm

Sign and verify a release artifact

quantumlock sign --file dist/myapp-1.4.2.tar.gz
# -> dist/myapp-1.4.2.tar.gz.qsig  (algorithm + production_grade printed)

quantumlock verify --file dist/myapp-1.4.2.tar.gz --signature dist/myapp-1.4.2.tar.gz.qsig

sign refuses to fall back to a non-production algorithm unless you pass --allow-dev-fallback, and any fallback is marked production_grade: false inside the .qsig bundle itself. See Security.

v2 artifacts end to end

quantumlock v2 create --subject customer-42 --days 365 --features premium --output artifact.json
quantumlock v2 validate artifact.json
quantumlock v2 revoke <jti> --reason chargeback
quantumlock v2 status <jti>

Getting Started

Guides

Reference

Platform

Command tree

Top-level

`quantumlock v2` — license artifacts

`quantumlock keys` — enterprise key lifecycle

`quantumlock entropy` — entropy jobs

`quantumlock secrets`

Worked examples

Configure, generate, validate

Key lifecycle with entropy provenance

Sign and verify a release artifact

v2 artifacts end to end

​Command tree

​Top-level

​quantumlock v2 — license artifacts

​quantumlock keys — enterprise key lifecycle

​quantumlock entropy — entropy jobs

​quantumlock secrets

​Worked examples

​Configure, generate, validate

​Key lifecycle with entropy provenance

​Sign and verify a release artifact

​v2 artifacts end to end

Command tree

Top-level

`quantumlock v2` — license artifacts

`quantumlock keys` — enterprise key lifecycle

`quantumlock entropy` — entropy jobs

`quantumlock secrets`

Worked examples

Configure, generate, validate

Key lifecycle with entropy provenance

Sign and verify a release artifact

v2 artifacts end to end