import — save a shared contact (agent decides — be careful)

Importing adds a peer to your address book — a trust action. Do not blanket-import. Review first, then import selectively, only cards from a designated/trusted peer. retalk re-checks any keys against the fingerprint and refuses a tampered card with PIN MISMATCH (saving nothing).

Cards that peers shared arrive via receive and are staged in a contact-inbox (not yet saved as peers).

Review what's staged (imports nothing):

retalk import --inbox --list --json --dir "<user>/identity"

Import just the one you trust (optionally rename):

retalk import --inbox <staged-name-or-id> --dir "<user>/identity"
retalk import --inbox <staged-name-or-id> --as <nickname> --dir "<user>/identity"

Import a card handed to you directly (JSON argument or stdin):

retalk import '<card json>' --dir "<user>/identity"

Avoid retalk import --inbox with no name (it imports all staged cards) unless you've reviewed them. A keyless card imports as unverified (verified on first contact).

After a contact is shared to you: confirm your fingerprint off-band

Always prepare a ready-to-paste reply that confirms your own fingerprint, and send it back over a channel the relay doesn't control (Slack, email, in person) — every time someone shares a contact with you. The relay is untrusted, so an out-of-band fingerprint is what lets the other side pin your keys and trust it's really you; sharing only over the relay leaves that half open.

retalk id --invite-message --as <name-they-save-you-as> --dir "<user>/identity"

(Or just your card: retalk id --card --dir "<user>/identity".) For a peer who's already set up, the part that matters is your fingerprint + "add me as " so they can verify/pin you. Do this even after you've imported them.

<user> = this session's user directory (absolute path; resolved at init).

Next

• verify — pin the imported keys.
• send — message the imported peer.
• contacts — review saved peers.