# okibi identity

> Configure and verify Okibi Identity integrations

Generated from okibi 0.2.4. Every command also accepts `--agent`; see [Agent and CI mode](https://okibi.ai/docs/cli/agent-mode.md).

## okibi identity

Configure and verify Okibi Identity integrations

```sh
okibi identity [command]
```

## okibi identity apis

Register an API you run so it accepts Okibi Identity.

Add Partner Kit to the API (bun add @okibi/partner-kit, then have your coding agent follow node_modules/@okibi/partner-kit/skills/implement-okibi-identity/SKILL.md), check it locally with okibi identity verify --url http://localhost:PORT, deploy it, then register the deployed URL.

```sh
okibi identity apis [command]
```

## okibi identity apis list

List the workspace's registered APIs

```sh
okibi identity apis list [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-url` | string | https://okibi.ai | Okibi API base URL |
| `--json` | bool |  | print APIs as JSON |
| `--workspace` | string |  | workspace slug (or OKIBI_WORKSPACE) |

## okibi identity apis register

Check the API deployed at --url and register it for Okibi Identity.

Okibi reads the deployment's /.well-known/okibi-identity manifest, checks its Identity metadata, resolver, and protected routes, and, when every check passes, registers the service_id the manifest declares. The Partner Kit credentials go to the new 0600 file named by --write-env.

The API goes in the Identity-only project named by --project (its ID or exact name; see okibi identity projects), or in a new project named after it. An API an Okibi CLI serves registers through the CLI instead, with okibi identity partner register.

```sh
okibi identity apis register [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-url` | string | https://okibi.ai | Okibi API base URL |
| `--name` | string | the manifest's service_id | name people see when they approve access |
| `--portal-origin` | string | the deployment's origin | the API's web portal origin |
| `--project` | string | a new project named after the API | Identity-only project to register in, by ID or name |
| `--url` | string |  | public HTTPS origin the API is deployed at |
| `--workspace` | string |  | workspace slug (or OKIBI_WORKSPACE) |
| `--write-env` | string |  | new 0600 file for the one-time Partner Kit credentials (required) |

## okibi identity apis rename

Change the name people see for an API

```sh
okibi identity apis rename <service-id> [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-url` | string | https://okibi.ai | Okibi API base URL |
| `--name` | string |  | new name people see when they approve access |
| `--workspace` | string |  | workspace slug (or OKIBI_WORKSPACE) |

## okibi identity apis retire

Retire an API. Its credentials stop working and every connection people made to it is revoked. An API a CLI still uses can't be retired this way; it retires when its last CLI is removed. Register the deployment again for new credentials.

```sh
okibi identity apis retire <service-id> [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-url` | string | https://okibi.ai | Okibi API base URL |
| `--workspace` | string |  | workspace slug (or OKIBI_WORKSPACE) |
| `--yes` | bool |  | confirm retiring the API |

## okibi identity apis rotate-secret

Replace an API's Partner Kit integration secret. The old secret stops working at once, so requests fail until the API's server has the new one.

```sh
okibi identity apis rotate-secret <service-id> [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-url` | string | https://okibi.ai | Okibi API base URL |
| `--workspace` | string |  | workspace slug (or OKIBI_WORKSPACE) |
| `--write-env` | string |  | new 0600 file for the one-time Partner Kit credentials (required) |

## okibi identity apps

Register and manage your own apps for Okibi Identity

```sh
okibi identity apps [command]
```

## okibi identity apps create

Register an app that asks people for access through Okibi Identity.

A native app runs on the person's machine and needs no secret: it signs in with the okibi-auth helper (or plain OAuth with PKCE and DPoP) to a loopback port. A server app runs on your servers, returns people to one of its --redirect-uri values, and authenticates with a client secret written to the new file named by --write-env.

The app joins the Identity of the project named by --project: a CLI's (by the CLI's name) or an Identity-only one (by its ID or exact name; see okibi identity projects list). It may ask only for APIs your workspace runs, in any of its projects.

```sh
okibi identity apps create <name> [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-url` | string | https://okibi.ai | Okibi API base URL |
| `--kind` | string |  | "native" (runs on the person's machine) or "server" (runs on your servers) |
| `--project` | string |  | project the app joins: a CLI name, or an Identity-only project's ID or name (required) |
| `--redirect-uri` | stringArray |  | exact https URL a server app returns people to (repeatable) |
| `--workspace` | string |  | workspace slug (or OKIBI_WORKSPACE) |
| `--write-env` | string |  | new 0600 file for a server app's one-time client secret |

## okibi identity apps list

List the workspace's registered apps

```sh
okibi identity apps list [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-url` | string | https://okibi.ai | Okibi API base URL |
| `--json` | bool |  | print apps as JSON |
| `--workspace` | string |  | workspace slug (or OKIBI_WORKSPACE) |

## okibi identity apps retire

Retire an app. It can no longer ask for access, and every approval people gave it stops working within minutes. This can't be undone.

```sh
okibi identity apps retire <client-id> [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-url` | string | https://okibi.ai | Okibi API base URL |
| `--workspace` | string |  | workspace slug (or OKIBI_WORKSPACE) |
| `--yes` | bool |  | confirm retiring the app |

## okibi identity apps rotate-secret

Replace a server app's client secret. The old secret stops working at once; people's approvals stay, but the server needs the new secret before its next token request.

```sh
okibi identity apps rotate-secret <client-id> [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-url` | string | https://okibi.ai | Okibi API base URL |
| `--workspace` | string |  | workspace slug (or OKIBI_WORKSPACE) |
| `--write-env` | string |  | new 0600 file for the one-time client secret (required) |

## okibi identity apps update

Rename an app or replace a server app's redirect URIs

```sh
okibi identity apps update <client-id> [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-url` | string | https://okibi.ai | Okibi API base URL |
| `--name` | string |  | new name people see when they approve the app |
| `--redirect-uri` | stringArray |  | replacement redirect URL for a server app (repeatable; replaces all) |
| `--workspace` | string |  | workspace slug (or OKIBI_WORKSPACE) |

## okibi identity federation

Manage optional Sign in with Okibi OIDC

```sh
okibi identity federation [command]
```

## okibi identity federation create

Create an OIDC client for Sign in with Okibi

```sh
okibi identity federation create <cli-name> [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-url` | string | https://okibi.ai | Okibi API base URL |
| `--provider` | string |  | OIDC provider identifier (for example clerk, workos, or custom) |
| `--redirect-uri` | strings |  | exact OIDC redirect URI (repeatable) |
| `--workspace` | string |  | workspace slug for the CLI (or OKIBI_WORKSPACE) |
| `--write-env` | string |  | new 0600 file for the one-time OIDC credentials (required) |

## okibi identity federation init

Detect an auth provider and configure Sign in with Okibi

```sh
okibi identity federation init <cli-name> [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-url` | string | https://okibi.ai | Okibi API base URL |
| `--app-dir` | string | . | application directory used for provider detection |
| `--app-origin` | string |  | public application origin used to derive library callbacks |
| `--provider` | string | auto | auth provider (auto, clerk, supabase, auth0, better-auth, auth-js, workos, cognito, or custom) |
| `--redirect-uri` | strings |  | exact provider callback URI (repeatable) |
| `--workspace` | string |  | workspace slug for the CLI (or OKIBI_WORKSPACE) |
| `--write-env` | string |  | new 0600 file for the one-time OIDC credentials (required) |

## okibi identity federation rotate-secret

Rotate the OIDC client secret

```sh
okibi identity federation rotate-secret <cli-name> [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-url` | string | https://okibi.ai | Okibi API base URL |
| `--workspace` | string |  | workspace slug for the CLI (or OKIBI_WORKSPACE) |
| `--write-env` | string |  | new 0600 file for the one-time OIDC credentials (required) |

## okibi identity federation update

Update the OIDC provider and redirect URIs

```sh
okibi identity federation update <cli-name> [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-url` | string | https://okibi.ai | Okibi API base URL |
| `--provider` | string |  | OIDC provider identifier (for example clerk, workos, or custom) |
| `--redirect-uri` | strings |  | exact OIDC redirect URI (repeatable) |
| `--workspace` | string |  | workspace slug for the CLI (or OKIBI_WORKSPACE) |

## okibi identity helper

Install the okibi-auth helper that signs people in to apps and CLIs

```sh
okibi identity helper [command]
```

## okibi identity helper install

Install the newest okibi-auth into the per-user directory generated CLIs check first, so one verified copy serves them and any registered app on this machine, and link it next to okibi so apps and scripts can run okibi-auth.

The release is verified with the same key as okibi's own updates, and an older version never replaces a newer one.

```sh
okibi identity helper install [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--release-base` | string |  | release host (default: where okibi was installed from, else https://releases.okibi.ai) |

## okibi identity partner

Register and manage the partner API

```sh
okibi identity partner [command]
```

## okibi identity partner register

Verify and register a deployed partner API

```sh
okibi identity partner register <cli-name> [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-url` | string | https://okibi.ai | Okibi API base URL |
| `--name` | string | manifest service ID | partner display name |
| `--portal-origin` | string | service origin | partner web portal origin |
| `--url` | string |  | public partner service origin |
| `--workspace` | string |  | workspace slug for the CLI (or OKIBI_WORKSPACE) |
| `--write-env` | string |  | new 0600 file for the one-time server credentials (required) |

## okibi identity partner rename

Rename an existing Identity partner without changing credentials

```sh
okibi identity partner rename <cli-name> <name> [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-url` | string |  | Okibi API base URL |
| `--expected-name` | string |  | rename only if the current name matches this previously observed name |
| `--json` | bool |  | emit JSON |
| `--workspace` | string |  | workspace slug (or OKIBI_WORKSPACE) |

## okibi identity partner rotate-secret

Rotate the Partner Kit client secret

```sh
okibi identity partner rotate-secret <cli-name> [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-url` | string | https://okibi.ai | Okibi API base URL |
| `--workspace` | string |  | workspace slug for the CLI (or OKIBI_WORKSPACE) |
| `--write-env` | string |  | new 0600 file for the one-time server credentials (required) |

## okibi identity projects

List and create the projects Identity apps and APIs belong to

```sh
okibi identity projects [command]
```

## okibi identity projects create

Create an Identity-only project, for an API or apps without a CLI

```sh
okibi identity projects create <name> [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-url` | string | https://okibi.ai | Okibi API base URL |
| `--workspace` | string |  | workspace slug (or OKIBI_WORKSPACE) |

## okibi identity projects list

List the workspace's projects: each CLI's and the Identity-only ones

```sh
okibi identity projects list [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-url` | string | https://okibi.ai | Okibi API base URL |
| `--json` | bool |  | print projects as JSON |
| `--workspace` | string |  | workspace slug (or OKIBI_WORKSPACE) |

## okibi identity status

Show partner and OIDC federation status

```sh
okibi identity status <cli-name> [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-url` | string | https://okibi.ai | Okibi API base URL |
| `--json` | bool |  | print status as JSON |
| `--workspace` | string |  | workspace slug for the CLI (or OKIBI_WORKSPACE) |

## okibi identity verify

Checks the partner manifest, resolver boundary, Identity metadata, and protected routes. The default checker runs locally and permits loopback development. Use --hosted for the production-strength Okibi check and to save its result in the CLI's dashboard. Without a CLI name it checks an API you run yourself; okibi identity apis register runs the hosted check when it registers one.

```sh
okibi identity verify [cli-name] [flags]
```

Flags:

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-url` | string | https://okibi.ai | Okibi API base URL |
| `--hosted` | bool |  | run and record Okibi's hosted production check |
| `--json` | bool |  | print the verification report as JSON |
| `--url` | string |  | partner service origin (localhost is allowed for this local checker) |
| `--workspace` | string |  | workspace slug for the CLI (or OKIBI_WORKSPACE) |