evidencectl client profile create command reference
Create a strict profile containing only references to local key material.
Contract status
Section titled “Contract status”This page is generated from the public Clap command tree for Registry Stack source version 0.30.0 and catalog SHA-256 2221f17eae216048d4cfaf7f66e3dcd68a250f6f6de4e24b177441819192b475. Hidden implementation commands are omitted.
evidencectl client profile create [OPTIONS] --base-url <BASE_URL> --client-id <CLIENT_ID> --output <OUTPUT> <--private-key-file <PATH>|--private-key-env <VARIABLE>>Constraints
Section titled “Constraints”| Condition | Requirement |
|---|---|
| Command invocation | Exactly one of --private-key-file <PATH>, --private-key-env <VARIABLE> is required. |
| Command invocation | --local-loopback-discovery and --pinned-jwks <PATH> cannot be used together. |
| Command invocation | --private-key-env <VARIABLE> and --private-key-file <PATH> cannot be used together. |
Options
Section titled “Options”| Option | Always required | Default | Values | Environment | Description |
|---|---|---|---|---|---|
--base-url <BASE_URL> | Yes | n/a | n/a | n/a | Evidence Gateway base URL. HTTPS is required by default |
--client-id <CLIENT_ID> | Yes | n/a | n/a | n/a | Registered OAuth client identifier |
--private-key-file <PATH> | No | n/a | n/a | n/a | Safe path to a private JWK, relative to the profile file |
--private-key-env <VARIABLE> | No | n/a | n/a | n/a | Environment variable holding the private JWK JSON |
--local-loopback-discovery | No | n/a | n/a | n/a | Permit discovery over plain HTTP only when the base URL is loopback |
--pinned-jwks <PATH> | No | n/a | n/a | n/a | Reviewed pinned JWKS file, relative to the profile file |
--contracts-file <PATH> | No | n/a | n/a | n/a | Reviewed contract catalog, relative to the profile file |
--maximum-assertion-lifetime-seconds <MAXIMUM_ASSERTION_LIFETIME_SECONDS> | No | 300 | n/a | n/a | Maximum accepted assertion lifetime in seconds |
--clock-skew-seconds <CLOCK_SKEW_SECONDS> | No | 30 | n/a | n/a | Accepted verifier clock skew in seconds |
--expected-audience <EXPECTED_AUDIENCE> | No | n/a | n/a | n/a | Optional expected audience override |
--expected-issuer <EXPECTED_ISSUER> | No | n/a | n/a | n/a | Optional expected Evidence issuer |
--expected-provider <EXPECTED_PROVIDER> | No | n/a | n/a | n/a | Optional expected Evidence provider |
--output <OUTPUT> | Yes | n/a | n/a | n/a | New owner-only profile file |
--format <output_format> | No | human | human, json | n/a | Select human-readable or machine-readable output |
-h, --help | No | n/a | n/a | n/a | Print help |
Generation contract
Section titled “Generation contract”Run npm run generate from docs/site after changing a public command, argument, option, default, environment binding, or help description.