evidencectl client profile create command reference
Create a strict profile containing only references to local key material.
Contract status
Section titled “Contract status”This page is generated from the public Clap command tree for Registry Stack source version 0.45.0 and catalog SHA-256 18546dbdf436972522108829ab0f8c804142a7474cfe3841e0b8ff10e061c842. Hidden implementation commands are omitted.
evidencectl client profile create [OPTIONS] --base-url <BASE_URL> --client-id <CLIENT_ID> --output <OUTPUT> <--private-key-file <PATH>|--private-key-env <VARIABLE>>Constraints
Section titled “Constraints”| Condition | Requirement |
|---|---|
| Command invocation | Exactly one of --private-key-file <PATH>, --private-key-env <VARIABLE> is required. |
| Command invocation | --local-loopback-discovery and --pinned-jwks <PATH> cannot be used together. |
| Command invocation | --private-key-env <VARIABLE> and --private-key-file <PATH> cannot be used together. |
Options
Section titled “Options”| Option | Always required | Repeatable | Default | Values | Environment | Description |
|---|---|---|---|---|---|---|
--base-url <BASE_URL> | Yes | No | n/a | n/a | n/a | Registry Evidence base URL. HTTPS is required by default |
--client-id <CLIENT_ID> | Yes | No | n/a | n/a | n/a | Registered OAuth client identifier |
--private-key-file <PATH> | No | No | n/a | n/a | n/a | Safe path to a private JWK, relative to the profile file |
--private-key-env <VARIABLE> | No | No | n/a | n/a | n/a | Environment variable holding the private JWK JSON |
--local-loopback-discovery | No | No | n/a | n/a | n/a | Permit discovery over plain HTTP only when the base URL is loopback |
--pinned-jwks <PATH> | No | No | n/a | n/a | n/a | Reviewed pinned JWKS file, relative to the profile file |
--contracts-file <PATH> | No | No | n/a | n/a | n/a | Reviewed contract catalog, relative to the profile file |
--maximum-assertion-lifetime-seconds <MAXIMUM_ASSERTION_LIFETIME_SECONDS> | No | No | 300 | n/a | n/a | Maximum accepted assertion lifetime in seconds |
--clock-skew-seconds <CLOCK_SKEW_SECONDS> | No | No | 30 | n/a | n/a | Accepted verifier clock skew in seconds |
--expected-audience <EXPECTED_AUDIENCE> | No | No | n/a | n/a | n/a | Optional expected audience override |
--expected-issuer <EXPECTED_ISSUER> | No | No | n/a | n/a | n/a | Optional expected Evidence issuer |
--expected-provider <EXPECTED_PROVIDER> | No | No | n/a | n/a | n/a | Optional expected Evidence provider |
--client-assertion-audience <AUDIENCE> | No | No | n/a | n/a | n/a | Audience of the client assertion presented at the token endpoint, when the issuer expects one other than the token endpoint URL (ThunderID v1.0.1 expects the issuer string). This is not the token request’s resource |
--resource <URI> | No | No | n/a | n/a | n/a | RFC 8707 resource indicator requested with the token: the resource server’s registered identifier, not a URL to fetch |
--scope <SCOPE> | No | Yes | n/a | n/a | n/a | Scope requested with the token. Repeat for several; a requested scope may narrow the client’s registered permission set, never widen it |
--output <OUTPUT> | Yes | No | n/a | n/a | n/a | New owner-only profile file |
--format <FORMAT> | No | No | human | human | n/a | Select human-readable output; this command provides no JSON report |
-h, --help | No | No | n/a | n/a | n/a | Print help |
Generation contract
Section titled “Generation contract”After changing a public command, argument, option, default, environment binding, or help description, run cargo run --locked -p registry-cli-docs -- --write, commit crates/registry-cli-docs/catalog.json, then run npm run generate from docs/site.