evidencectl client profile create command reference
Create a strict profile containing only references to local key material.
Contract status
Section titled “Contract status”This page is generated from the public Clap command tree for Registry Stack source version 0.34.0 and catalog SHA-256 521175a69262e60df96745886392348e5bb8d82e63cdd24bdf4baa80d46e5ff4. Hidden implementation commands are omitted.
evidencectl client profile create [OPTIONS] --base-url <BASE_URL> --client-id <CLIENT_ID> --output <OUTPUT> <--private-key-file <PATH>|--private-key-env <VARIABLE>>Constraints
Section titled “Constraints”| Condition | Requirement |
|---|---|
| Command invocation | Exactly one of --private-key-file <PATH>, --private-key-env <VARIABLE> is required. |
| Command invocation | --local-loopback-discovery and --pinned-jwks <PATH> cannot be used together. |
| Command invocation | --private-key-env <VARIABLE> and --private-key-file <PATH> cannot be used together. |
Options
Section titled “Options”| Option | Always required | Repeatable | Default | Values | Environment | Description |
|---|---|---|---|---|---|---|
--base-url <BASE_URL> | Yes | No | n/a | n/a | n/a | Evidence Gateway base URL. HTTPS is required by default |
--client-id <CLIENT_ID> | Yes | No | n/a | n/a | n/a | Registered OAuth client identifier |
--private-key-file <PATH> | No | No | n/a | n/a | n/a | Safe path to a private JWK, relative to the profile file |
--private-key-env <VARIABLE> | No | No | n/a | n/a | n/a | Environment variable holding the private JWK JSON |
--local-loopback-discovery | No | No | n/a | n/a | n/a | Permit discovery over plain HTTP only when the base URL is loopback |
--pinned-jwks <PATH> | No | No | n/a | n/a | n/a | Reviewed pinned JWKS file, relative to the profile file |
--contracts-file <PATH> | No | No | n/a | n/a | n/a | Reviewed contract catalog, relative to the profile file |
--maximum-assertion-lifetime-seconds <MAXIMUM_ASSERTION_LIFETIME_SECONDS> | No | No | 300 | n/a | n/a | Maximum accepted assertion lifetime in seconds |
--clock-skew-seconds <CLOCK_SKEW_SECONDS> | No | No | 30 | n/a | n/a | Accepted verifier clock skew in seconds |
--expected-audience <EXPECTED_AUDIENCE> | No | No | n/a | n/a | n/a | Optional expected audience override |
--expected-issuer <EXPECTED_ISSUER> | No | No | n/a | n/a | n/a | Optional expected Evidence issuer |
--expected-provider <EXPECTED_PROVIDER> | No | No | n/a | n/a | n/a | Optional expected Evidence provider |
--client-assertion-audience <AUDIENCE> | No | No | n/a | n/a | n/a | Audience of the client assertion presented at the token endpoint, when the issuer expects one other than the token endpoint URL (ThunderID v1.0.1 expects the issuer string). This is not the token request’s resource |
--resource <URI> | No | No | n/a | n/a | n/a | RFC 8707 resource indicator requested with the token: the resource server’s registered identifier, not a URL to fetch |
--scope <SCOPE> | No | Yes | n/a | n/a | n/a | Scope requested with the token. Repeat for several; a requested scope may narrow the client’s registered permission set, never widen it |
--output <OUTPUT> | Yes | No | n/a | n/a | n/a | New owner-only profile file |
--format <output_format> | No | No | human | human, json | n/a | Select human-readable or machine-readable output |
-h, --help | No | No | n/a | n/a | n/a | Print help |
Generation contract
Section titled “Generation contract”Run npm run generate from docs/site after changing a public command, argument, option, default, environment binding, or help description.