sftp-users

An environment can have additional SFTP accounts next to its main SSH and SFTP login, for example one per developer or one limited to the uploads folder. The sftp-users commands manage them. For the main login, see ssh.

kinstactl sftp-users list my-site --env live
kinstactl sftp-users add my-site deploy --env live --permission write
kinstactl sftp-users delete my-site deploy --env live --yes

Without --env, a site with one environment uses it; a site with several gets a picker on a terminal and fails with ENV_REQUIRED in a script. See Sites and environments. Commands that change something wait for Kinsta to finish by default, and accept --no-wait, --timeout <minutes> and --dry-run; see operations.

sftp-users list

List the additional SFTP accounts of an environment.

kinstactl sftp-users list my-site --env staging

kinstactl sftp-users list [site] [options]

List the additional SFTP accounts of an environment

Arguments

Argument	Description
`site`	site name, display name or ID

Options

Option	Description
`--env <environment>`	environment name or ID

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, GET /sites/{site_id}/environments, GET /sites/environments/{env_id}/additional-sftp-accounts

The table shows the username, root directory, permission and ID of each account, and whether it is active. Below it, the command reports whether additional accounts are enabled for the environment and on which port.

sftp-users add

Add an additional SFTP account to an environment.

kinstactl sftp-users add my-site deploy --env live --permission write

kinstactl sftp-users add <site> <username> [options]

Add an additional SFTP account to an environment

Arguments

Argument	Description
`site`	site name, display name or ID
`username`	username of the new SFTP account

Options

Option	Description
`--env <environment>`	environment name or ID
`--password <password>`	"-" reads it from stdin; omitted on a TTY prompts
`--root-directory <path>`	directory the account is restricted to
`--permission <read\|write>`	access level of the account
`--dry-run`	print the resolved target and request; change nothing
`--no-wait`	return the operation ID instead of waiting
`--timeout <minutes>`	give up waiting after this many minutes (default 30)

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, POST /sites/environments/{env_id}/additional-sftp-accounts

The account needs a password. On a terminal you are prompted for it, with hidden input. In a script there is no prompt, so pass --password <value>, or --password - to read it from stdin, which keeps it out of your shell history and the process list:

cat password.txt | kinstactl sftp-users add my-site deploy --env live --password - --permission write

Without a password the command fails with a USAGE error. The password is never echoed back: --dry-run shows the request with it masked as ***.

--permission takes read or write. --root-directory restricts the account to a directory:

cat password.txt | kinstactl sftp-users add my-site reader --env live --password - --root-directory /wp-content/uploads --permission read --dry-run

sftp-users enable

Enable the additional SFTP accounts of an environment.

kinstactl sftp-users enable my-site --env live

kinstactl sftp-users enable [site] [options]

Enable the additional SFTP accounts of an environment

Arguments

Argument	Description
`site`	site name, display name or ID

Options

Option	Description
`--env <environment>`	environment name or ID
`--dry-run`	print the resolved target and request; change nothing
`--no-wait`	return the operation ID instead of waiting
`--timeout <minutes>`	give up waiting after this many minutes (default 30)

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, PUT /sites/environments/{env_id}/additional-sftp-accounts/toggle-status

This switches the feature on for the whole environment, not a single account. It needs no confirmation.

sftp-users disable

Disable the additional SFTP accounts of an environment.

kinstactl sftp-users disable my-site --env live

kinstactl sftp-users disable [site] [options]

Disable the additional SFTP accounts of an environment

Arguments

Argument	Description
`site`	site name, display name or ID

Options

Option	Description
`--env <environment>`	environment name or ID
`--dry-run`	print the resolved target and request; change nothing
`--no-wait`	return the operation ID instead of waiting
`--timeout <minutes>`	give up waiting after this many minutes (default 30)

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, PUT /sites/environments/{env_id}/additional-sftp-accounts/toggle-status

The accounts are kept, but they cannot log in until you run sftp-users enable. It needs no confirmation.

sftp-users delete

Delete an additional SFTP account.

kinstactl sftp-users delete my-site deploy --env live --yes

kinstactl sftp-users delete <site> <username> [options]

Delete an additional SFTP account

Arguments

Argument	Description
`site`	site name, display name or ID
`username`	username of the SFTP account, see: sftp-users list

Options

Option	Description
`--env <environment>`	environment name or ID
`--dry-run`	print the resolved target and request; change nothing
`--no-wait`	return the operation ID instead of waiting
`--timeout <minutes>`	give up waiting after this many minutes (default 30)
`--yes`	skip the confirmation prompt

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, GET /sites/environments/{env_id}/additional-sftp-accounts, DELETE /sites/environments/additional-sftp-accounts/{sftp_account_id}

The account is looked up by username, ignoring case, so a typo fails with the list of usernames the environment has. Deleting is destructive, so the command asks for confirmation. On a terminal you answer a prompt; in a script pass --yes, otherwise it fails with CONFIRMATION_REQUIRED (exit code 5).