OIDC-GEN(1)

📦
version 5.3.8 · 9 versions
, in epel 10, fedora 43, fedora 44

💅 oidc-gen — bestie edition

okay so this is oidc-gen, a User Command, and it's literally the tool that generates account configurations for oidc-agent. that's the whole vibe. 🫶

✨ NAME ✨

oidc-gen — generates account configurations for oidc-agent. no cap, that's the job. 👑

🌸 SYNOPSIS 🌸

oidc-gen [OPTION...] [ACCOUNT_SHORTNAME]

🦋 DESCRIPTION 🦋

oidc-gen is the tool for generating oidc account configurations which can be used by oidc-add. it's giving "I make the config, my friend oidc-add uses the config." iconic division of labor tbh. 💖

🎀 Managing account configurations

  • -d, --delete — delete the configuration for the given account. gone. bye. 💀
  • -l, --accounts — prints a list of all your configured account configurations. literally the same as running oidc-add -l.
  • -p, --print=FILE — prints the decrypted content of FILE. and FILE can be either an absolute path, or just the name of a file sitting in oidc-dir (like, say, an account configuration short name). ✨
  • --reauthenticate — this one updates an existing account configuration file with a new refresh token. use it when you want a fresh token and don't need to touch any other metadata. periodt.
  • --rename=NEW_SHORTNAME — renames an existing account configuration file. glow-up for your filenames. 💅
  • -u, --update=FILE — decrypts and then reencrypts the content for FILE. heads up bestie, this might update the file format and the encryption. FILE can be an absolute path or the name of a file placed in oidc-dir (e.g. an account configuration short name).

🌈 Generating a new account configuration

  • --client-id=CLIENT_ID — uses CLIENT_ID as the client id. this requires an already registered client. also, sneaky: it implicitly sets -m. 🙈
  • --client-secret=CLIENT_SECRET — uses CLIENT_SECRET as the client secret. also requires an already registered client.
  • -e, --edit — edit an existing account configuration. same as --manual, except the account configuration has to already exist. no creating from scratch here.
  • -f, --file=FILE — reads the client configuration from FILE. implicitly sets -m.
  • --iss=ISSUER_URL, --issuer=ISSUER_URL — sets ISSUER_URL as the issuer url to be used.
  • --mytoken=PROFILE — a mytoken profile string to use.
  • --mytoken-profile=PROFILE — yeah, that's the profile one.
  • --mytoken-url[=URI], --mytoken-issuer[=URI] — the url of a mytoken instance to use.
  • -m, --manual — does not use Dynamic Client Registration. the client has to be manually registered beforehand, bestie, that part's on you.
  • --no-save — do not save any configuration files. which means… the moment the agent stops, nothing will be saved. it's giving "here for a good time, not a long time." 💀
  • --oauth2, --oauth — set this when you're using an OAuth2 provider.
  • --port=PORT — use this port in the local redirect uri. it's a shorter way to pass redirect uris compared to --redirect-uri. and yes, you can use this option multiple times to provide additional backup ports. 🎀
  • --pub — uses a public client defined in the publicclient.conf file.
  • --redirect-uri=URI, --redirect-url=URI — uses URI as the redirect URI. it can be a space separated list. and listen — the redirect uri must follow the format http://localhost:<port>[/*] or edu.kit.data.oidc-agent:/<anything>. no freestyling. 🚫
  • --scope=SCOPE — sets SCOPE as the scope to be used. multiple scopes can be provided as a space separated list, or by using the option multiple times. use max to use all available scopes for this provider. slay.
  • --scope-all, --scope-max — use all available scopes for this provider. same as using --scope=max. ✨

👑 Generating a new account configuration — Advanced

  • --at=ACCESS_TOKEN, --access-token=ACCESS_TOKEN — uses ACCESS_TOKEN for authorization at the registration endpoint.
  • --aud=AUDIENCE, --audience=AUDIENCE — limit issued tokens to the specified AUDIENCE. multiple audiences can be specified separated by space.
  • --cnid=IDENTIFIER, --client-name-identifier=IDENTIFIER — an additional identifier used in the client name, to distinguish clients on different machines that have the same short name. like, the host name, for example.
  • --configuration-endpoint=ENDPOINT_URI, --config-endpoint=ENDPOINT_URI, --discovery-endpoint=ENDPOINT_URI — uses this uri as the configuration endpoint to read the server's metadata from.
  • --cp=FILE, --cert-path=FILE, --cert-file=FILE — FILE is the path to a CA bundle file that will be used with TLS communication. 🔒
  • --dae=ENDPOINT_URI, --device-authorization-endpoint=ENDPOINT_URI — uses this uri as the device authorization endpoint.
  • --only-at — when you use this option, oidc-gen prints an access token instead of creating a new account configuration. no account configuration file gets created. heads up though: this option does not work with dynamic client registration, but it does work with preregistered public clients. 💅
  • --op-password=PASSWORD — uses PASSWORD in the password flow. requires --flow=password to be set.
  • --op-username=USERNAME — uses USERNAME in the password flow. requires --flow=password to be set.
  • --rt=REFRESH_TOKEN, --refresh-token=REFRESH_TOKEN — uses REFRESH_TOKEN as the refresh token in the refresh flow, instead of using another flow. implicitly sets --flow=refresh.
  • --rt-env[=OIDC_REFRESH_TOKEN], --refresh-token-env[=OIDC_REFRESH_TOKEN] — like --rt, but it reads the REFRESH_TOKEN from the passed environment variable (default: OIDC_REFRESH_TOKEN). 🌸
  • -w, --flow=code|device|password|refresh — specifies the OIDC flow to be used. you can use this option multiple times to allow different flows and to express priority. very main character of you.

💜 Advanced

  • --codeExchange=URI — uses URI to complete the account configuration generation process. URI must be a full url to which you were redirected after the authorization code flow.
  • --confirm-default — confirms all confirmation prompts with the default value.
  • --confirm-no — confirms all confirmation prompts with no.
  • --confirm-yes — confirms all confirmation prompts with yes. yes-queen behavior, honestly. 👑
  • --no-scheme — this option applies only when the authorization code flow is used. oidc-agent will not use a custom uri scheme redirect.
  • --no-url-call — does not automatically open the authorization url in a browser.
  • --no-webserver — this option applies only when the authorization code flow is used. oidc-agent will not start a webserver. redirection to oidc-gen through a custom uri scheme redirect uri and 'manual' redirect is possible.
  • --prompt=cli|gui|none — changes the mode of how oidc-gen should prompt for information. the default is cli.
  • --pw-cmd=CMD — a command from which oidc-gen can read the encryption password, instead of prompting the user. 🎀
  • --pw-env[=OIDC_ENCRYPTION_PW] — reads the encryption password from the passed environment variable (default: OIDC_ENCRYPTION_PW), instead of prompting the user.
  • --pw-file=FILE — uses the first line of FILE as the encryption password.
  • --pw-gpg=KEY_ID, --pw-pgp=KEY_ID, --gpg=KEY_ID, --pgp=KEY_ID — uses the passed GPG KEY for encryption.
  • --pw-prompt=cli|gui — changes the mode of how oidc-gen should prompt for passwords. the default is cli.

🧚 Internal options

  • --state=STATE — only for internal usage. uses STATE to get the associated account config. not for you, bestie, this one's the tool's own business. 🙈

⭐ Verbosity

  • -g, --debug — sets the log level to DEBUG.
  • -v, --verbose — enables verbose mode.

🔥 Help

  • -?, --help — give this help list.
  • --usage — give a short usage message.
  • -V, --version — print program version.
📢 Mandatory or optional arguments to long options are also mandatory or optional for any corresponding short options. (yes that sentence is a whole mood and yes it's still true.)

🍓 FILES 🍓

  • ~/.config/oidc-agent or ~/.oidc-agent — oidc-gen reads and writes account and client configurations in this directory. this is home base. 💖
  • /etc/oidc-agent/issuer.config — this file is used by oidc-gen to give a list of possible issuer urls. the user should not edit this file. it might be overwritten when updating oidc-agent. if you want to specify additional issuer urls, the user can use the issuer.config located in the oidc-directory instead. 🚫✏️
  • ~/.config/oidc-agent/issuer.config or ~/.oidc-agent/issuer.config — this file (combined with /etc/oidc-agent/issuer.config) is used by oidc-gen to give a list of possible issuer urls. the user can add additional issuer urls to this list, one url per line. ✨

🌈 EXAMPLES 🌈

  • oidc-gen example — generates a new account configuration with name 'example' using dynamic client registration. the classic. ✨
  • oidc-gen example -m — generates a new account configuration with name 'example' NOT using dynamic client registration.
  • oidc-gen example -f ~/.config/oidc-agent/example.com_2018-01-31_f34a.clientconfig — generates a new account configuration using the client configuration stored in ~/.config/oidc-agent/example.com_2018-01-31_f34a.clientconfig.
  • oidc-gen example --at=token1234 — generates a new account configuration with name 'example' using dynamic client registration. the access token token1234 is used for authorization at the (protected) registration endpoint. 🔥

💀 REPORTING BUGS 💀

found a bug? report bugs to https://github.com/indigo-dc/oidc-agent/issues 🐛

and subscribe to the mailing list to receive important updates about oidc-agent: https://www.lists.kit.edu/sympa/subscribe/oidc-agent-user.

🫶 SEE ALSO 🫶

oidc-agent(1), oidc-add(1), oidc-token(1)

low-traffic mailing list with updates such as critical security incidents and new releases: https://www.lists.kit.edu/sympa/subscribe/oidc-agent-user

full documentation can be found at https://indigo-dc.github.io/oidc-agent/usage/oidc-gen/

okay that's the whole page, bestie, you ate it. 💅 this was oidc-gen 5.3.8, dated September 2026, and you can find the whole thing filed under OIDC-GEN(1). mwah. 😘🎀

📦 where this page comes from