Registry stack documentation: machine-readable Markdown.
Index of all pages: https://docs.registrystack.org/dev/llms.txt
Full corpus: https://docs.registrystack.org/dev/llms-full.txt

# evidencectl client profile create command reference

> Generated syntax and options for evidencectl client profile create.

{/* Generated from Clap command definitions by scripts/generate-cli-reference.mjs. Run npm run generate. */}

Create a strict profile containing only references to local key material.

## Contract status

This page is generated from the public Clap command tree for Registry Stack source version `0.30.0` and catalog SHA-256 `2221f17eae216048d4cfaf7f66e3dcd68a250f6f6de4e24b177441819192b475`. Hidden implementation commands are omitted.

## Usage

```text
evidencectl client profile create [OPTIONS] --base-url <BASE_URL> --client-id <CLIENT_ID> --output <OUTPUT> <--private-key-file <PATH>|--private-key-env <VARIABLE>>
```

## Constraints

| Condition | Requirement |
| --- | --- |
| Command invocation | Exactly one of `--private-key-file <PATH>`, `--private-key-env <VARIABLE>` is required. |
| Command invocation | `--local-loopback-discovery` and `--pinned-jwks <PATH>` cannot be used together. |
| Command invocation | `--private-key-env <VARIABLE>` and `--private-key-file <PATH>` cannot be used together. |

## Options

| Option | Always required | Default | Values | Environment | Description |
| --- | --- | --- | --- | --- | --- |
| `--base-url <BASE_URL>` | Yes | n/a | n/a | n/a | Evidence Gateway base URL. HTTPS is required by default |
| `--client-id <CLIENT_ID>` | Yes | n/a | n/a | n/a | Registered OAuth client identifier |
| `--private-key-file <PATH>` | No | n/a | n/a | n/a | Safe path to a private JWK, relative to the profile file |
| `--private-key-env <VARIABLE>` | No | n/a | n/a | n/a | Environment variable holding the private JWK JSON |
| `--local-loopback-discovery` | No | n/a | n/a | n/a | Permit discovery over plain HTTP only when the base URL is loopback |
| `--pinned-jwks <PATH>` | No | n/a | n/a | n/a | Reviewed pinned JWKS file, relative to the profile file |
| `--contracts-file <PATH>` | No | n/a | n/a | n/a | Reviewed contract catalog, relative to the profile file |
| `--maximum-assertion-lifetime-seconds <MAXIMUM_ASSERTION_LIFETIME_SECONDS>` | No | `300` | n/a | n/a | Maximum accepted assertion lifetime in seconds |
| `--clock-skew-seconds <CLOCK_SKEW_SECONDS>` | No | `30` | n/a | n/a | Accepted verifier clock skew in seconds |
| `--expected-audience <EXPECTED_AUDIENCE>` | No | n/a | n/a | n/a | Optional expected audience override |
| `--expected-issuer <EXPECTED_ISSUER>` | No | n/a | n/a | n/a | Optional expected Evidence issuer |
| `--expected-provider <EXPECTED_PROVIDER>` | No | n/a | n/a | n/a | Optional expected Evidence provider |
| `--output <OUTPUT>` | Yes | n/a | n/a | n/a | New owner-only profile file |
| `--format <output_format>` | No | `human` | `human`, `json` | n/a | Select human-readable or machine-readable output |
| `-h, --help` | No | n/a | n/a | n/a | Print help |

## Generation contract

Run `npm run generate` from `docs/site` after changing a public command, argument, option, default, environment binding, or help description.