OIDC-TOKEN(1)

💖 oidc-token — the bestie that fetches your OIDC access tokens 💖

okay so real talk, oidc-token is a User Command from the oidc-agent fam, and it is literally your little token-fetching sidekick. It goes and gets you OIDC access tokens from oidc-agent and hands them over. no cap.

---

✨ SYNOPSIS ✨

oidc-token [OPTION...] ACCOUNT_SHORTNAME | ISSUER_URL

like. you give it an account shortname or an issuer URL, and you can sprinkle options on top. that's the whole vibe. 🦋

---

🌸 DESCRIPTION 🌸

oidc-token — a client for oidc-agent for getting OIDC access tokens. she's giving "middleman but make it cute". here's everything she can do, grouped all nicely:

💅 General

• --auth-header, --auth — returns the token but wrapped up inside an http authorization header, so it's ready to use with stuff like curl or httpie. plug and play, periodt.
• -a, --all — returns all the available info: the token, the issuer, and the expiration time. each value gets its own line. one value per line, no chaos. ✨
• --bearer — returns the token in bearer format, which is the format that works as the value for an http authorization header. it's giving "header-ready".
• -c, --env — this one gets all the available info (same as -a), but instead of just printing it, it prints shell commands that export environment variables (with the default names). the result is literally the same as running oidc-token -o -i -e. and if you want to rename each env var, the -o, -i and -e options let you do exactly that. slay.
• -e, --expires-at[=OIDC_EXP] — returns the expiration time for the access token you asked for. here's the tea: if neither -i nor -o is set and you didn't pass OIDC_EXP, the expiration time just gets printed to stdout. otherwise, shell commands get printed that export the value into an environment variable. and yes, you can name that variable with OIDC_EXP. 🎀
• -f, --force-new — forces a brand new access token to be issued and returned. no reusing, we're getting a fresh one bestie.
• -i, --issuer[=OIDC_ISS] — returns the issuer associated with the access token you requested. if neither -e nor -o is set and you didn't pass OIDC_ISS, the issuer gets printed to stdout. otherwise shell commands get printed that export the value into an environment variable. name it with OIDC_ISS. 💜
• -o, --token[=OIDC_AT] — returns the access token you asked for. if neither -i nor -e is set and you didn't pass OIDC_AT, the token gets printed to stdout (which is the exact same behaviour as not passing this option at all, iykyk). otherwise shell commands get printed that export the value into an environment variable. and the name of that variable can be set with OIDC_AT.
• -t, --time=SECONDS — minimum number of seconds the access token should still be valid for. she checks the freshness. ⭐

🔥 Advanced

• --aud=AUDIENCE — the audience for the access token you're requesting. you can provide multiple audiences as a space separated list. go off.
• --id-token — returns an id-token instead of an access token. > ⚠️ heads up bestie: this option is meant as a development tool. ID-tokens should not be passed as authorization to resources. not the move, okay? 💀
• -m, --mytoken[=PROFILE], --MT[=PROFILE] — returns a mytoken instead of an access token. to specify the properties of the issued mytoken, pass a mytoken profile. > 🚨 important: this option can only be used with account shortnames, not with issuer urls. no exceptions, fr fr.
• --name=NAME — this one is for other applications / scripts that call oidc-token to obtain an access token. NAME is the name of that application, and it might get displayed to the user. so like, introduce yourself properly. 🙈
• -s, --scope=SCOPE — the scope to be requested for the access token. you can provide multiple scopes as a space separated list, or by using the option multiple times. both? both. 🫶

🧚 Help

• -?, --help — give this help list. she's helping!
• --usage — give a short usage message. the tl;dr version.
• -V, --version — print program version. 📌

💡 little note that matters: mandatory or optional arguments to long options are also mandatory or optional for any corresponding short options. so like, the rules carry over, okay?

---

🍓 FILES 🍓

oidc-token does not read or write any files. she's low maintenance. nothing on disk, no mess, iconic. ✨

---

🌈 EXAMPLES 🌈

okay these are the actual moves, copy them exactly bestie:

oidc-token example

Gets an access token for the 'example' account configuration.

oidc-token example -t 60

Gets an access token for the 'example' account configuration which will be valid for at least 60 seconds.

oidc-token example -i

Gets the issuer url associated to the requested access token.

oidc-token example -a

Gets an access token, the associated issuer url, and the expiration date of the token. One information per line.

eval `oidc-token example -c`

Sets environment variables with the access token, the associated issuer url, and the expiration date of the token.

oidc-token example --scope=openid --scope=profile

Gets an access token for the 'example' account configuration which will be only valid for the 'openid' and 'profile' scope.

---

😭 REPORTING BUGS 😭

found a bug? don't suffer in silence, tell the devs:

Report bugs to <https://github.com/indigo-dc/oidc-agent/issues>

Subscribe to our mailing list to receive important updates about oidc-agent: <https://www.lists.kit.edu/sympa/subscribe/oidc-agent-user>.

---

👑 SEE ALSO 👑

• oidc-agent(1), oidc-add(1), oidc-gen(1)

Low-traffic mailing list with updates such as critical security incidents and new releases: https://www.lists.kit.edu/sympa/subscribe/oidc-agent-user

Full documentation can be found at https://indigo-dc.github.io/oidc-agent/usage/oidc-token/

---

and that's the whole page, bestie 💖 this one's oidc-token version 5.3.8, dated September 2026 — go forth and fetch those tokens, you absolute main character. 🎀✨🦋