OIDC-AGENT(1)

✨ OIDC-AGENT(1) ✨

okay bestie, welcome to the oidc-agent manual page, part of the User Commands crew 💅 this is your girl's guide to the whole thing, no skips, no cap.

---

🌸 NAME 🌸

oidc-agent — the OIDC token agent, aka your little token-handling bestie 🎀

---

💖 SYNOPSIS 💖

oidc-agent [OPTION...]

---

🦋 DESCRIPTION 🦋

So oidc-agent is literally an agent to manage oidc token. That's the whole vibe. ✨

🌈 General:

• --always-allow-idtoken — always allow id-token requests, no manual approval from the user needed. It just goes. periodt.
• -a, --socket-path=PATH, --bind-address=PATH — creates the UNIX-domain socket used to talk to the agent at this PATH. The default is $TMPDIR/oidc-XXXXXX/oidc-agent.<ppid>. If you want random characters swapped in, put XXXXXX as the last six characters of a directory in the path. 🫶
• -c, --confirm — requires user confirmation when an application requests an access token for any loaded configuration. she asks first, always. 🙈
• --json — prints agent socket and pid as JSON instead of bash.
• -k, --kill — kills the current agent, the one given by the OIDCD_PID environment variable. bye bestie 💀
• --no-autoload — disables the autoload feature: a token request cannot load the needed configuration. You have to do it yourself with oidc-add.
• --no-autoreauthenticate, --no-auto-reauthenticate — disables the automatic re-authentication feature: if a refresh token expired, the re-atuhentiacte is not started automatically; you have to do it manually. (yes, the original says "re-atuhentiacte", we don't gatekeep typos 💜)
• --no-scheme — this option applies only when the authorization code flow is used. oidc-agent will not use a custom uri scheme redirect.
• --no-webserver — this option applies only when the authorization code flow is used. oidc-agent will not start a webserver. Redirection to oidc-gen through a custom uri scheme redirect uri and 'manual' redirect is possible.
• --pid-file=PATH — if given, the pid is written to this file.
• --quiet — disable informational messages to stdout. shhh 🤫
• --restart-on-update — enables automatic restart of the agent if its binary changes. glow up on reload ✨
• -t, --lifetime=TIME — sets a default value in seconds for the maximum lifetime of account configurations added to the agent. A lifetime specified for an account configuration with oidc-add overwrites this default value. Without this option the default maximum lifetime is forever. iconic forever-girl behavior 👑
• --with-group[=GROUP_NAME] — this option allows that applications running under another user can access the agent. The user running the other application and the user running the agent have to be in the specified group. If no GROUP_NAME is specified the default is 'oidc-agent'.

🌟 Verbosity:

• -d, --console — runs oidc-agent on the console, without daemonizing.
• -g, --debug — sets the log level to DEBUG. we love a chatty queen 🔥
• --log-stderr — additionally prints log messages to stderr.
• --status — connects to the currently running agent and prints status information about it. vibe check on your agent 💅
• --trace-http=FILE — writes all HTTP interactions with the OpenID Provider to FILE for diagnostic purposes.

⚠️ WARNING: the trace file will contain sensitive data including tokens and credentials. no fr fr, be careful with that file 😭

🎀 Help:

• -?, --help — give this help list
• --usage — give a short usage message
• -V, --version — print program version

Mandatory or optional arguments to long options are also mandatory or optional for any corresponding short options. (iykyk, that's just how option-parsing works 🧚)

---

🌸 FILES 🌸

• $TMPDIR/oidc-XXXXXX/oidc-agent.<ppid> — UNIX-domain sockets used to contain the connection to the agent. 🦋

---

💜 EXAMPLES 💜

• oidc-agent Starts oidc-agent and prints the commands needed for setting the required environment variables.
• eval `oidc-agent` Starts oidc-agent and sets the required environment variables (only for this shell).
• oidc-agent > ~/tmp/oidc-agent.env Starts oidc-agent and exports the needed shell commands to ~/tmp/oidc-agent.env. Can be used to persist the agent.

---

🙈 REPORTING BUGS 🙈

Report bugs to <https://github.com/indigo-dc/oidc-agent/issues>

Subscribe to our mailing list to receive important updates about oidc-agent: <https://www.lists.kit.edu/sympa/subscribe/oidc-agent-user>.

---

⭐ SEE ALSO ⭐

oidc-gen(1), oidc-add(1), oidc-token(1), oidc-keychain(1)

Low-traffic mailing list with updates such as critical security incidents and new releases: <https://www.lists.kit.edu/sympa/subscribe/oidc-agent-user>

Full documentation can be found at <https://indigo-dc.github.io/oidc-agent/usage/oidc-agent/>

---

and that's the whole page, bestie!! 🫶 this was oidc-agent version 5.3.8, dated September 2026 — slay, stay tokenized, and don't leak your trace file 💖✨