OIDC-TOKENSH(1)

📦
version 5.3.8 · 5 versions
, in epel 10, fedora 43, fedora 44

💖 OIDC-TOKENSH — the manual page, but make it cute 💖

okay bestie, sit down, hydrate, and let me tell you about oidc-tokensh, a User Command that lives in section 1 of the manual and is literally about to change your whole token situation. no cap. 🫶

✨ NAME ✨

oidc-tokensh — bestie, it makes sure you always have a valid Access Token. always. like, it's not even a vibe, it's a guarantee. 💅

oidc-tokensh starts a whole new shell, and inside that shell oidc-agent is available to you. if an account configuration needs unlocking, it'll ask you for a password — only when it actually needs to, which is very considerate of it honestly. 🎀

and the Access Tokens? they get automatically renewed for the account you specified, before they expire. not after. before. it's giving "responsible queen who pays her bills early." 👑

🌸 SYNOPSIS 🌸

oidc-tokensh [-h] [oidc-token options] -- [command]

🦋 DESCRIPTION 🦋

real talk: this tool is based on httokensh by Dave Dykstra. shoutout to Dave, icon behaviour. 💜

what it does is: it runs oidc-agent and oidc-token with the options you gave it, starts your command, and then keeps running oidc-token in the background as needed to renew the token — right up until your command exits. so it's just over there, quietly refreshing your tokens the entire time you're doing your little tasks. main character energy from a background process, we love to see it. ✨

🎀 OPTIONS 🎀

  • -h, --help — shows this help message and then exits. classic. the "wait what does this do again" button. 🙈
  • --oidc <name>|<OP-url> — the name or the url of the oidc-agent configuration you wanna use. give it a name, give it a url, it's flexible like that. 💫
  • --minsecs <seconds> — the minimum lifetime your token should have. like, "don't let it get below this many seconds, pls." ⏳
  • -o|--outfile <file> — specify an alternative file for storing the Access Token. you want it somewhere else? say the word. 🍓
  • -v|--verbose — shows debug output. turn this on when you wanna see everything that's happening. it's giving surveillance but make it consensual. 🔍

also, super important: command defaults to $SHELL. so if you don't pass anything, it just hands you your own shell. cozy. 🌈

and one more thing, and I say this with love: please specify the oidc-agent shortname that you wish to use. it's not optional energy, bestie. it needs to know. 💅

🧚 FILES 🧚

it's looking at one of these, depending on your setup:

  • $XDG_RUNTIME_DIR/bt_u$ID
  • /tmp/bt_u$ID
  • or $BEARER_TOKEN_FILE

💜 SEE ALSO 💜

go read these too, they're all in the same friend group:

there's also a low-traffic mailing list with updates — things like critical security incidents and new releases (so, y'know, the stuff you actually want to know about):

https://www.lists.kit.edu/sympa/subscribe/oidc-agent-user

and the full documentation lives at:

https://indigo-dc.github.io/oidc-agent/usage/oidc-tokensh/
⭐ heads up: the footer of the original page was literally mid-sentence — it says "Trying to auto-detect oidc-ag..." — and it's stamped September 2026, for oidc-tokensh in section 1 of the User Commands. so that's the source, the version vibe, and the date. the page was mid-thought and honestly? relatable. 😭

anyway that's the whole page, every single option and path and link is in there, nothing skipped, no cap. go get your tokens renewed, you gorgeous little sysadmin. 🫶💖🎀

📦 where this page comes from