$ cast key-authorization sign --help

Usage: cast key-authorization sign [OPTIONS] --chain-id <CHAIN_ID> <KEY_ADDRESS>

Arguments:
  <KEY_ADDRESS>
          Key address to authorize

Options:
      --chain-id <CHAIN_ID>
          Chain ID for replay protection

      --key-type <KEY_TYPE>
          Type of access key being authorized: secp256k1, p256, or webauthn. The
          root signature type is determined by the configured signer
          
          [default: secp256k1]

      --expiry <EXPIRY>
          Expiry timestamp (unix seconds). Omit for no expiry

      --enforce-limits
          Enforce spending limits for this key. With no --limit entries, this
          means no spending

      --limit <LIMITS>
          Spending limit in `TOKEN:AMOUNT[:PERIOD]` format. Can be specified
          multiple times

      --scope <SCOPE>
          Call scope restriction in `TARGET[:SELECTORS[@RECIPIENTS]]` format.
          TARGET alone allows all calls to that target

      --scopes <SCOPES_JSON>
          Call scope restrictions as a JSON array

      --witness <WITNESS>
          Optional TIP-1053 witness to include in the authorization signing
          hash.
          
          `0x000...000` is a valid present witness and is distinct from omitting
          the flag.

  -h, --help
          Print help (see a summary with '-h')

  -j, --threads <THREADS>
          Number of threads to use. Specifying 0 defaults to the number of
          logical cores
          
          [aliases: --jobs]

Wallet options - raw:
  -f, --from <ADDRESS>
          The sender account
          
          [env: ETH_FROM=]

  -i, --interactive
          Open an interactive prompt to enter your private key

      --private-key <RAW_PRIVATE_KEY>
          Use the provided private key

      --mnemonic <MNEMONIC>
          Use the mnemonic phrase of mnemonic file at the specified path

      --mnemonic-passphrase <PASSPHRASE>
          Use a BIP39 passphrase for the mnemonic

      --mnemonic-derivation-path <PATH>
          The wallet derivation path.
          
          Works with both --mnemonic-path and hardware wallets.

      --mnemonic-index <INDEX>
          Use the private key from the given mnemonic index.
          
          Used with --mnemonic-path.
          
          [default: 0]

Wallet options - keystore:
      --keystore <PATH>
          Use the keystore in the given folder or file
          
          [env: ETH_KEYSTORE=]

      --account <ACCOUNT_NAME>
          Use a keystore from the default keystores folder
          (~/.foundry/keystores) by its filename
          
          [env: ETH_KEYSTORE_ACCOUNT=]

      --password <PASSWORD>
          The keystore password.
          
          Used with --keystore.

      --password-file <PASSWORD_FILE>
          The keystore password file path.
          
          Used with --keystore.
          
          [env: ETH_PASSWORD=]

Wallet options - hardware wallet:
  -l, --ledger
          Use a Ledger hardware wallet

  -t, --trezor
          Use a Trezor hardware wallet

Wallet options - remote:
      --aws
          Use AWS Key Management Service.
          
          Ensure the AWS_KMS_KEY_ID environment variable is set.

      --gcp
          Use Google Cloud Key Management Service.
          
          Ensure the following environment variables are set: GCP_PROJECT_ID,
          GCP_LOCATION, GCP_KEY_RING, GCP_KEY_NAME, GCP_KEY_VERSION.
          
          See: [https://cloud.google.com/kms/docs](https://cloud.google.com/kms/docs)

      --turnkey
          Use Turnkey.
          
          Ensure the following environment variables are set:
          TURNKEY_API_PRIVATE_KEY, TURNKEY_ORGANIZATION_ID, TURNKEY_ADDRESS.
          
          See: [https://docs.turnkey.com/getting-started/quickstart](https://docs.turnkey.com/getting-started/quickstart)

Wallet options - Tempo:
      --tempo.access-key <PRIVATE_KEY>
          Tempo access key private key.
          
          When set, the transaction is signed with this access key on behalf of
          `--tempo.root-account`.
          
          [env: TEMPO_ACCESS_KEY=]

      --tempo.root-account <ADDRESS>
          Tempo root account address (the `from` address for keychain
          transactions).
          
          Required when `--tempo.access-key` is set.
          
          [env: TEMPO_ROOT_ACCOUNT=]

Wallet options - browser wallet:
      --browser
          Use a browser wallet

      --browser-port <PORT>
          Port for the browser wallet server
          
          [default: 9545]

      --browser-disable-open
          Whether to open the browser for wallet connection

Display options:
      --color <COLOR>
          The color of the log messages

          Possible values:
          - auto:   Intelligently guess whether to use color output (default)
          - always: Force color output
          - never:  Force disable color output

      --json
          Format log messages as JSON

      --machine
          Activate the agent contract: disables color and wraps CLI-runtime
          exits (parse / usage / help / version) in a structured envelope.
          Per-command machine output (declared `output_mode`, progress and
          prompt suppression, canonical exit codes) is adopted incrementally —
          see `docs/agents/spec` §10. Mutually exclusive with `--json` and
          `--md` to keep machine-mode output unambiguous

      --md
          Format log messages as Markdown

  -q, --quiet
          Do not print log messages

  -v, --verbosity...
          Verbosity level of the log messages.
          
          Pass multiple times to increase the verbosity (e.g. -v, -vv, -vvv).
          
          Depending on the context the verbosity levels have different meanings.
          
          For example, the verbosity levels of the EVM are:
          - 2 (-vv): Print logs for all tests.
          - 3 (-vvv): Print execution traces for failing tests.
          - 4 (-vvvv): Print execution traces for all tests, and setup traces
          for failing tests.
          - 5 (-vvvvv): Print execution and setup traces for all tests,
          including storage changes and
            backtraces with line numbers.