NVME-KEYS-REVOKE(1)

📦 version 3.2, in arch rolling

💅 NVME-KEYS-REVOKE(1) — the NVMe Manual, but make it make sense

okay so bestie, welcome to nvme-keys-revoke from the NVMe Manual ✨ this is the little command that ✨ revokes ✨ a key, and yes we're gonna walk through it together, no cap.

🌸 NAME 🌸

nvme-keys-revoke — revoke a NVMe TLS PSK from a keyring 🎀

like, the key is gone gone. it's giving "you're uninvited to the group chat" energy.

🦋 SYNOPSIS 🦋

nvme [<global-options>] keys revoke [--keyring=<name> | -k <name>]
                        [--keytype=<type> | -t <type>]
                        --identity=<description> | -i <description>

read it slowly, it's literally just nvme → keys → revoke with some flags stacked on top 💖 and notice that --identity / -i is required, okay? not optional, not vibes-based.

👑 DESCRIPTION 👑

revoke an NVMe TLS pre-shared key (PSK) from the system keyring.

that's it, that's the whole thing 🫶 it's a PSK, it's pre-shared, it's TLS, and it's about to be evicted from the system keyring. main character exit. 💀

✨ OPTIONS ✨

  • -k <name>, --keyring=<name> — the name of the keyring you're revoking the key from. default is .nvme — yes with the lil dot in front, don't @ me 🎀
  • -t <type>, --keytype=<type> — the type of the key you're revoking. default is psk 🦋
  • -i <description>, --identity=<description> — the identity (description) of the key to revoke. this one's the whole point, don't skip it 💅

🌈 GLOBAL OPTIONS 🌈

these bad boys live at the top-level nvme command, and they're available to this subcommand too. so you can absolutely sprinkle them on top of your keys revoke 🧚

  • --dry-run — print the command that would be executed, but don't actually execute it. it's giving dress rehearsal 🎭
  • --no-ioctl-probing — disable probing for 64-bit IOCTL support.
  • --no-retries — disable retry logic on transient errors. one shot, one opportunity 😤
  • -o <fmt>, --output-format=<fmt> — set the reporting format to normal, tabular, json, or binary. only one output format may be used at a time, so pick your fave and commit 💖
  • --output-format-version=<version> — select the output format version. version 1 uses the original field naming, while version 2 (the default) provides more consistent and script-friendly field names. other versions are rejected, periodt 🚫
  • --quiet — suppress informational messages. errors are still reported, and --quiet cancels any --verbose for the library log level. so like, it wins the argument 🫶
  • --set-options=<key=value>[,<key=value>...] — set libnvme library options for this invocation. supported keys are force-4k, mi-probe-enabled, test-base-dir and test-sysfs-dir ⭐
  • --timeout=<ms> — set the timeout for the command in milliseconds. infinite or -1 waits without a time limit (0xffffffff). the way that timeout just never ends 😭
  • -v, --verbose — increase the level of detail in the output. may be specified multiple times to further increase verbosity. stack it, you know you want to 🔥
these options can also be set as machine-wide defaults in nvme-cli.conf(5). and a command-line flag always overrides the file — the CLI is the main character here, the config file is just the supporting cast 👑

💜 EXAMPLES 💜

  • revoke a key using its description and verify with keyctl:
# nvme keys revoke --identity="NVMe0R01 hostnqn0 subsys0"

# keyctl show
Session Keyring
 573249525 --alswrv      0     0  keyring: _ses
 353599402 --alswrv      0 65534   \_ keyring: _uid.0
 475911922 ---lswrv      0     0   \_ keyring: .nvme
649274894: key inaccessible (Key has been revoked)

look at that last line 😭 the key is inaccessible because it's been revoked — that's the proof, bestie. iykyk 💅

🔥 NVME 🔥

part of the nvme-user suite 🦋

okay that's the whole page, go revoke some keys, drink water, and remember: --identity is not optional 🎀✨

nvme-user suite · dated 10/30/2026 · bye bestie, ily 🫶💖

📦 where this page comes from