CLI Reference

The drs CLI manages DRS nodes via the Cloudflare API. It handles initialization, address management, DNS configuration, and deployment.

Global Options

Most commands require Cloudflare credentials:

Flag	Description
`--cf-token <token>`	Cloudflare API token
`--account-id <id>`	Cloudflare account ID
`--kv-namespace <id>`	KV namespace ID (for address/config operations)
`--json`	Output as JSON (for scripting)

Commands

`drs init`

Initialize a new DRS node. Creates DNS records, KV namespaces, and generates an Ed25519 keypair.

drs init --domain mycompany.com --cf-token <token>

What it creates:

KV namespace for addresses
KV namespace for config
_drs._tcp.mycompany.com SRV record
_drskey.mycompany.com TXT record with the public key
Initial node config and manifest in KV

Output: Public key, private key, KV namespace IDs, and next steps.

`drs add-address`

Add a routable address to the node.

drs add-address <local-part> \
  --routes '[{"value_type":"USDC","transfer_type":"ethereum","destination":"0x..."}]' \
  --cf-token <token> --account-id <id> --kv-namespace <addresses-id>

`drs remove-address`

Remove an address from the node.

drs remove-address <local-part> \
  --cf-token <token> --account-id <id> --kv-namespace <addresses-id>

`drs list-addresses`

List all configured addresses.

drs list-addresses \
  --cf-token <token> --account-id <id> --kv-namespace <addresses-id>

`drs update-config`

Update the node’s accepted pairs or default contract TTL. Recomputes the optional manifest.

drs update-config \
  --accepts '[{"value_type":"USDC","transfer_type":"ethereum"},{"value_type":"ETH","transfer_type":"ethereum"}]' \
  --cf-token <token> --account-id <id> --kv-namespace <config-id>

Add --admin <contact> to publish an operator contact in the manifest. Add --ttl <seconds> to change the default routing-contract TTL (30–3600).

`drs check-dns`

Verify that DNS records are correctly configured for a domain.

drs check-dns mycompany.com

Checks for:

_drs._tcp SRV record (port 443, valid target)
_drskey TXT record (valid base64 public key, 32 bytes)

`drs test-resolve`

Perform a full end-to-end resolution: DNS discovery, resolve, and signature verification.

drs test-resolve alice@mycompany.com

`drs status`

Probe a DRS node by fetching its /.well-known/directory.json. Prints the protocol version, accepted-pair count, and admin contact if the manifest is published. Exits non-zero if the endpoint is unreachable.

drs status mycompany.com

`drs rotate-key`

Generate a new Ed25519 keypair and update (or create) the _drskey DNS TXT record. For zero-downtime rotation, add the new key as an additional TXT record first, wait for DNS TTLs to expire, switch the Worker secret, then remove the old record.

drs rotate-key --domain mycompany.com --cf-token <token>

After rotation, update the Worker secret:

wrangler secret put DRS_SIGNING_KEY --env mycompany

`drs sync`

Sync local YAML address files to KV. Useful for managing addresses as code.

drs sync --dir ./addresses \
  --cf-token <token> --account-id <id> --kv-namespace <addresses-id>

Address file format (addresses/alice.yaml):

status: active
routes:
  - value_type: USDC
    transfer_type: ethereum
    destination: "0xABC..."
  - value_type: ETH
    transfer_type: ethereum
    destination: "0xABC..."