Using o2idctl

o2idctl is O2ID's standalone management CLI — it talks to a running O2ID server's HTTP API to manage users, applications, and roles.

Install the latest o2idctl binary for your platform (Linux and macOS, amd64 and arm64) with:

curl -fsSL https://o2id.dev/install.sh | sh -s o2idctl

This downloads the latest release from GitHub releases and installs it onto your PATH (/usr/local/bin by default — set INSTALL_DIR to change it).

Alternatively, download the binary for your platform manually from the releases page.

Profiles

o2idctl can talk to multiple O2ID deployments, each saved as a named profile.

o2idctl config

prompts for an API base URL and a profile name, and saves it. Select which profile the current terminal session uses with:

o2idctl use <profile>

Profiles (including the tokens login stores, below) are saved as JSON under $O2IDCTL_CONFIG_DIR, or o2id in your OS's user config directory by default.

Authentication

The O2ID management API is an OAuth2-protected resource: every request needs a valid Bearer access token. o2idctl login gets one for you without ever handling your password directly — it runs a real authorization-code + PKCE flow against a well-known o2idctl OAuth client, using a local loopback listener as the redirect target:

o2idctl config
o2idctl use local
o2idctl login

login prints (and tries to open) a URL; log in through the browser as usual, and o2idctl stores the resulting access and refresh tokens on the selected profile. Access tokens expire after an hour — o2idctl refreshes automatically using the stored refresh token, so you don't need to run login again unless the refresh token itself is revoked or expires.

Next steps

See the CLI Reference for the full command list, and Managing Users, Managing Applications, and Managing Roles for task-focused guides. See the API Reference for the scope each endpoint requires, which determines what a logged-in profile is allowed to do.