You
Your person key, invites, disk and AWS access. Only you see this page.
Your invites
An invite gives you a slot in a store. Accept it to pin the store to your person key.
payments
$ person acceptlayr person accept --site https://cloud.acme.dev --invite 7f3a91c2
$ person acceptlayr person accept --invite-file invite.age --remote s3://acme-layr/shop
Your person key
One key opens every project you may read. Layr Cloud never holds it.
- Recipient
- age1alc7w3q0…f5e09t2q
- Opens
- 4 projects, 6 stores
- Recovery
- 24 recovery words, made on Oct 2, 2026
$ person keyslayr person keys
Your disk
One Finder disk shows every store you may read. It is read only and served on 127.0.0.1.
- Mode
- all stores
- Folder
- ~/Layr
- Service
- ws.layr.mount · starts at login · opens stores only from the Keychain
- Address
- http://127.0.0.1:8095
| Store | On this Mac | Opened by | |
|---|---|---|---|
| shop | ✓ unlocked | Keychain (machine slot) | |
| payments | ✓ unlocked | Keychain (person key) | |
| infra | locked | · | |
| docs-site-3f2a | ● no address | pin from an invite | run layr person accept again with --remote <url> |
A locked store shows one file, LOCKED.txt, until you unlock it. A lock stays after a restart.
$ mount --statuslayr mount --status
$ mount --unlocklayr mount --unlock infra --paper-key-file ~/private/infra-words
$ mount --locklayr mount --lock shop
$ mount --installlayr mount --install --all
AWS access
For s3:// remotes Layr reads your AWS profile: static keys or IAM Identity Center (SSO). It refuses credential_process and profiles that assume a role.
- Profile
- acme-dev (SSO)
- Token
- valid for 6 h 20 min, renewed automatically
$ remote loginlayr remote login vault
$ config remote.vault.aws-profilelayr config remote.vault.aws-profile acme-dev