okibi identity

okibi identity apis

Register an API you run so it accepts Okibi Identity.

Add Partner Kit to the API (bun add @okibi/partner-kit, then have your coding agent follow node_modules/@okibi/partner-kit/skills/implement-okibi-identity/SKILL.md), check it locally with okibi identity verify --url http://localhost:PORT, deploy it, then register the deployed URL.

okibi identity apis [command]

okibi identity apis list

List the workspace's registered APIs

okibi identity apis list [flags]

okibi identity apis register

Check the API deployed at --url and register it for Okibi Identity.

Okibi reads the deployment's /.well-known/okibi-identity manifest, checks its Identity metadata, resolver, and protected routes, and, when every check passes, registers the service_id the manifest declares. The Partner Kit credentials go to the new 0600 file named by --write-env.

The API goes in the Identity-only project named by --project (its ID or exact name; see okibi identity projects), or in a new project named after it. An API an Okibi CLI serves registers through the CLI instead, with okibi identity partner register.

okibi identity apis register [flags]

okibi identity apis rename

Change the name people see for an API

okibi identity apis rename <service-id> [flags]

okibi identity apis retire

Retire an API. Its credentials stop working and every connection people made to it is revoked. An API a CLI still uses can't be retired this way; it retires when its last CLI is removed. Register the deployment again for new credentials.

okibi identity apis retire <service-id> [flags]

okibi identity apis rotate-secret

Replace an API's Partner Kit integration secret. The old secret stops working at once, so requests fail until the API's server has the new one.

okibi identity apis rotate-secret <service-id> [flags]

okibi identity apps

Register and manage your own apps for Okibi Identity

okibi identity apps [command]

okibi identity apps create

Register an app that asks people for access through Okibi Identity.

A native app runs on the person's machine and needs no secret: it signs in with the okibi-auth helper (or plain OAuth with PKCE and DPoP) to a loopback port. A server app runs on your servers, returns people to one of its --redirect-uri values, and authenticates with a client secret written to the new file named by --write-env.

The app joins the Identity of the project named by --project: a CLI's (by the CLI's name) or an Identity-only one (by its ID or exact name; see okibi identity projects list). It may ask only for APIs your workspace runs, in any of its projects.

okibi identity apps create <name> [flags]

okibi identity apps list

List the workspace's registered apps

okibi identity apps list [flags]

okibi identity apps retire

Retire an app. It can no longer ask for access, and every approval people gave it stops working within minutes. This can't be undone.

okibi identity apps retire <client-id> [flags]

okibi identity apps rotate-secret

Replace a server app's client secret. The old secret stops working at once; people's approvals stay, but the server needs the new secret before its next token request.

okibi identity apps rotate-secret <client-id> [flags]

okibi identity apps update

Rename an app or replace a server app's redirect URIs

okibi identity apps update <client-id> [flags]

okibi identity federation

Manage optional Sign in with Okibi OIDC

okibi identity federation [command]

okibi identity federation create

Create an OIDC client for Sign in with Okibi

okibi identity federation create <cli-name> [flags]

okibi identity federation init

Detect an auth provider and configure Sign in with Okibi

okibi identity federation init <cli-name> [flags]

okibi identity federation rotate-secret

Rotate the OIDC client secret

okibi identity federation rotate-secret <cli-name> [flags]

okibi identity federation update

Update the OIDC provider and redirect URIs

okibi identity federation update <cli-name> [flags]

okibi identity helper

Install the okibi-auth helper that signs people in to apps and CLIs

okibi identity helper [command]

okibi identity helper install

Install the newest okibi-auth into the per-user directory generated CLIs check first, so one verified copy serves them and any registered app on this machine, and link it next to okibi so apps and scripts can run okibi-auth.

The release is verified with the same key as okibi's own updates, and an older version never replaces a newer one.

okibi identity helper install [flags]

okibi identity partner

Register and manage the partner API

okibi identity partner [command]

okibi identity partner register

Verify and register a deployed partner API

okibi identity partner register <cli-name> [flags]

okibi identity partner rename

Rename an existing Identity partner without changing credentials

okibi identity partner rename <cli-name> <name> [flags]

okibi identity partner rotate-secret

Rotate the Partner Kit client secret

okibi identity partner rotate-secret <cli-name> [flags]

okibi identity projects

List and create the projects Identity apps and APIs belong to

okibi identity projects [command]

okibi identity projects create

Create an Identity-only project, for an API or apps without a CLI

okibi identity projects create <name> [flags]

okibi identity projects list

List the workspace's projects: each CLI's and the Identity-only ones

okibi identity projects list [flags]

okibi identity status

Show partner and OIDC federation status

okibi identity status <cli-name> [flags]

okibi identity verify

Checks the partner manifest, resolver boundary, Identity metadata, and protected routes. The default checker runs locally and permits loopback development. Use --hosted for the production-strength Okibi check and to save its result in the CLI's dashboard. Without a CLI name it checks an API you run yourself; okibi identity apis register runs the hosted check when it registers one.

okibi identity verify [cli-name] [flags]