Registry stack documentation: machine-readable Markdown.
Index of all pages: https://docs.registrystack.org/llms.txt
Full corpus: https://docs.registrystack.org/llms-full.txt

# evidencectl client profile create command reference

> Generated syntax and options for evidencectl client profile create.

{/* Generated from Clap command definitions by scripts/generate-cli-reference.mjs. Run npm run generate. */}

Create a strict profile containing only references to local key material.

## Contract status

This page is generated from the public Clap command tree for Registry Stack source version `0.34.0` and catalog SHA-256 `521175a69262e60df96745886392348e5bb8d82e63cdd24bdf4baa80d46e5ff4`. Hidden implementation commands are omitted.

## Usage

```text
evidencectl client profile create [OPTIONS] --base-url <BASE_URL> --client-id <CLIENT_ID> --output <OUTPUT> <--private-key-file <PATH>|--private-key-env <VARIABLE>>
```

## Constraints

| Condition | Requirement |
| --- | --- |
| Command invocation | Exactly one of `--private-key-file <PATH>`, `--private-key-env <VARIABLE>` is required. |
| Command invocation | `--local-loopback-discovery` and `--pinned-jwks <PATH>` cannot be used together. |
| Command invocation | `--private-key-env <VARIABLE>` and `--private-key-file <PATH>` cannot be used together. |

## Options

| Option | Always required | Repeatable | Default | Values | Environment | Description |
| --- | --- | --- | --- | --- | --- | --- |
| `--base-url <BASE_URL>` | Yes | No | n/a | n/a | n/a | Evidence Gateway base URL. HTTPS is required by default |
| `--client-id <CLIENT_ID>` | Yes | No | n/a | n/a | n/a | Registered OAuth client identifier |
| `--private-key-file <PATH>` | No | No | n/a | n/a | n/a | Safe path to a private JWK, relative to the profile file |
| `--private-key-env <VARIABLE>` | No | No | n/a | n/a | n/a | Environment variable holding the private JWK JSON |
| `--local-loopback-discovery` | No | No | n/a | n/a | n/a | Permit discovery over plain HTTP only when the base URL is loopback |
| `--pinned-jwks <PATH>` | No | No | n/a | n/a | n/a | Reviewed pinned JWKS file, relative to the profile file |
| `--contracts-file <PATH>` | No | No | n/a | n/a | n/a | Reviewed contract catalog, relative to the profile file |
| `--maximum-assertion-lifetime-seconds <MAXIMUM_ASSERTION_LIFETIME_SECONDS>` | No | No | `300` | n/a | n/a | Maximum accepted assertion lifetime in seconds |
| `--clock-skew-seconds <CLOCK_SKEW_SECONDS>` | No | No | `30` | n/a | n/a | Accepted verifier clock skew in seconds |
| `--expected-audience <EXPECTED_AUDIENCE>` | No | No | n/a | n/a | n/a | Optional expected audience override |
| `--expected-issuer <EXPECTED_ISSUER>` | No | No | n/a | n/a | n/a | Optional expected Evidence issuer |
| `--expected-provider <EXPECTED_PROVIDER>` | No | No | n/a | n/a | n/a | Optional expected Evidence provider |
| `--client-assertion-audience <AUDIENCE>` | No | No | n/a | n/a | n/a | Audience of the client assertion presented at the token endpoint, when the issuer expects one other than the token endpoint URL (ThunderID v1.0.1 expects the issuer string). This is not the token request's resource |
| `--resource <URI>` | No | No | n/a | n/a | n/a | RFC 8707 resource indicator requested with the token: the resource server's registered identifier, not a URL to fetch |
| `--scope <SCOPE>` | No | Yes | n/a | n/a | n/a | Scope requested with the token. Repeat for several; a requested scope may narrow the client's registered permission set, never widen it |
| `--output <OUTPUT>` | Yes | No | n/a | n/a | n/a | New owner-only profile file |
| `--format <output_format>` | No | No | `human` | `human`, `json` | n/a | Select human-readable or machine-readable output |
| `-h, --help` | No | No | n/a | n/a | n/a | Print help |

## Generation contract

Run `npm run generate` from `docs/site` after changing a public command, argument, option, default, environment binding, or help description.