OIDC-ADD(1)

💅 oidc-add — the manual page, but make it make sense

okay so bestie, welcome to oidc-add, part of the oidc-agent lineup (that's section 1 of the user commands, for the record). This is the client you use to add and remove account configurations to and from oidc-agent. Think of it like the bouncer at the club door of your agent — letting configs in, kicking configs out, locking the doors, whatever. Iconic behavior, honestly.

---

✨ SYNOPSIS ✨

oidc-add [OPTION...] ACCOUNT_SHORTNAME | -a | -l | -x | -X | -R

so basically you either hand it an ACCOUNT_SHORTNAME, or you run it in one of those modes at the end. periodt.

---

🌸 DESCRIPTION 🌸

oidc-add — a client for adding and removing accounts to the oidc-agent. That's the whole assignment and she ate.

💖 General:

• --always-allow-idtoken — Always allow id-token requests without manual approval by the user, for this account configuration. no more "hey can I get an id token 🥺" pop-ups for this one, she's trusted.
• -a, --loaded — Lists the currently loaded account configurations. what's already in the building, basically.
• -c, --confirm — Require user confirmation when an application requests an access token for this configuration. yes she WILL ask, every single time.
• -f, --force — Force to load the account configuration into the agent, even if it was already loaded. she's already there?? load her again anyway, we said so.
• -l, --list — Lists all configured account configurations. not just the loaded ones — ALL of them, the full roster.
• --pw-cmd=CMD — Command from which the agent can read the encryption password. let the agent go fetch the password itself via CMD.
• --pw-env[=OIDC_ENCRYPTION_PW] — Reads the encryption password from the passed environment variable (default: OIDC_ENCRYPTION_PW), instead of prompting the user. no typing, no prompts, just vibes from the env.
• --pw-file=FILE — Uses the first line of FILE as the encryption password. just the first line bestie, don't get creative.
• --pw-prompt=cli|gui — Change the mode how oidc-add should prompt for passwords. The default is 'cli'. pick your fighter.
• --pw-store[=TIME] — Keeps the encryption password encrypted in memory for TIME seconds. Default value for TIME: Forever. forever is a long time btw 😭
• -p, --print — Prints the encrypted account configuration and exits. show me the goods then immediately dip.
• --remote — Use a remote central oidc-agent, instead of a local one. long distance relationship with your agent, sure.
• -r, --remove — The account configuration is unloaded, not added. bye girl 👋
• -R, --remove-all — Unloads all account configurations currently loaded. clearing the whole building, no survivors.
• --skip-check — Indicates that the agent should load the account configuration without checking it, i.e. no access token is obtained on load. no test drive, straight to the garage.
• -t, --lifetime=TIME — Set a maximum lifetime in seconds when adding the account configuration. she's on a timer, lowkey dramatic of her.
• -x, --lock — Lock agent 🔒
• -X, --unlock — Unlock agent 🔓

🦋 Verbosity:

• -g, --debug — Sets the log level to DEBUG. she's telling you EVERYTHING.
• -v, --verbose — Enables verbose mode. more words, more clarity.

🎀 Help:

• -?, --help — Give this help list. classic.
• --usage — Give a short usage message. the tl;dr version.
• -V, --version — Print program version. who is she? she'll tell you.

Mandatory or optional arguments to long options are also mandatory or optional for any corresponding short options. so like, don't think you can sneak past the rules by using the short one bestie, same energy both ways 💀

---

🫶 FILES 🫶

• ~/.config/oidc-agent/ or ~/.oidc-agent/ — oidc-add reads account and client configurations in this directory. that's her house, that's where her stuff lives.

---

🌈 EXAMPLES 🌈

• ``` oidc-add example

Adds the `'example'` account configuration to `oidc-agent`. welcome in 💖

- ```
oidc-add example -r

Removes the 'example' account configuration from oidc-agent. we hardly knew ye.

• ``` oidc-add example -t 300

Adds the `'example'` account configuration to `oidc-agent`. It will be automatically removed after 5 minutes (`300s`). she's here for a good time, not a long time ✨

- ```
oidc-add -R

Removes all loaded account configurations from oidc-agent. mass exit.

• ``` oidc-add -x

Locks the agent. Use `-X` to unlock. 🔐

---

# 😭 REPORTING BUGS 😭

Found something cursed? Report bugs to <https://github.com/indigo-dc/oidc-agent/issues> — they wanna hear it, fr fr.

Also, subscribe to the mailing list to receive important updates about `oidc-agent`: <https://www.lists.kit.edu/sympa/subscribe/oidc-agent-user>. not me telling you to subscribe, but like... subscribe.

---

# 💜 SEE ALSO 💜

- `oidc-agent(1)`, `oidc-gen(1)`, `oidc-token(1)` — the rest of the friend group, go say hi.

Low-traffic mailing list with updates such as critical security incidents and new releases: <https://www.lists.kit.edu/sympa/subscribe/oidc-agent-user>

Full documentation can be found at <https://indigo-dc.github.io/oidc-agent/usage/oidc-add/> — the full lore, if you're a completionist 🧚

---

and that's the whole page bestie 🎀 this was **`oidc-add` version `5.3.8`**, dated **September 2026**, and yes I'm obsessed with her. mwah 💅✨