Skip to main content

SecureAuth command line reference

The SecureAuth binary, authorization, runs the server and its maintenance tasks, such as database migrations and configuration import and export. This reference lists every command and flag. It is generated from the SecureAuth source on each docs build, so it matches the current release.

Most global flags set the key of the same name in the configuration reference. For example, --server.port sets server.port.

Global flags​

These flags work with every command.

      --client.rootCA.path string       path to the http client root ca
      --client.timeout string           http client timeout (default "5s")
      --demo                            turn on demo app
      --dev                             turn on dev mode
  -h, --help                            help for authorization
      --integration.apis.enabled        enable integration apis
      --queue.disabled                  disable queue
      --secret.id string                key identifier (default "default")
      --secret.key string               key value
      --server.cache.disabled           disable server cache
      --server.cert.path string         path to the http server certificate
      --server.key.path string          path to the http server private key
      --server.mtls string              client authentication policy (default "NoClientCert")
      --server.port int                 http server port (default 8443)
      --server.tls.disabled             disable tls
      --server.url string               http server url
      --sql.migrations.disable          disable migrations on startup
      --sql.migrations.down             migrate database down before up
      --sql.migrations.path string      path to the directory with migrations (default "./migrations")
      --sql.migrations.timeout string   timeout for migrations (default "60s")
      --sql.type string                 postgresql/cockroachdb
      --sql.url string                  postgresql database url
      --swagger                         turn on swagger ui

Commands​

authorization completion​

Generate the autocompletion script for authorization for the specified shell. See each sub-command's help for details on how to use the generated script.

Options

  -h, --help   help for completion

authorization completion bash​

Generate the autocompletion script for the bash shell.

This script depends on the 'bash-completion' package. If it is not installed already, you can install it via your OS's package manager.

To load completions in your current shell session:

source <(authorization completion bash)

To load completions for every new session, execute once:

Linux:​

authorization completion bash > /etc/bash_completion.d/authorization

macOS:​

authorization completion bash > $(brew --prefix)/etc/bash_completion.d/authorization

You will need to start a new shell for this setup to take effect.

authorization completion bash

Options

  -h, --help              help for bash
      --no-descriptions   disable completion descriptions

authorization completion fish​

Generate the autocompletion script for the fish shell.

To load completions in your current shell session:

authorization completion fish | source

To load completions for every new session, execute once:

authorization completion fish > ~/.config/fish/completions/authorization.fish

You will need to start a new shell for this setup to take effect.

authorization completion fish [flags]

Options

  -h, --help              help for fish
      --no-descriptions   disable completion descriptions

authorization completion powershell​

Generate the autocompletion script for powershell.

To load completions in your current shell session:

authorization completion powershell | Out-String | Invoke-Expression

To load completions for every new session, add the output of the above command to your powershell profile.

authorization completion powershell [flags]

Options

  -h, --help              help for powershell
      --no-descriptions   disable completion descriptions

authorization completion zsh​

Generate the autocompletion script for the zsh shell.

If shell completion is not already enabled in your environment you will need to enable it. You can execute the following once:

echo "autoload -U compinit; compinit" >> ~/.zshrc

To load completions in your current shell session:

source <(authorization completion zsh)

To load completions for every new session, execute once:

Linux:​

authorization completion zsh > "${fpath[1]}/_authorization"

macOS:​

authorization completion zsh > $(brew --prefix)/share/zsh/site-functions/_authorization

You will need to start a new shell for this setup to take effect.

authorization completion zsh [flags]

Options

  -h, --help              help for zsh
      --no-descriptions   disable completion descriptions

authorization config​

Print current configuration

authorization config [flags]

Options

      --config string       config files
      --consul-key string   read configuration from consul
  -h, --help                help for config
      --vault-key string    read configuration from vault

authorization export​

Export tenant configuration using local database or via http. Do not provide issuer url to retrieve from local database. Provide issuer url, client id, client secret to retrieve configuration over http.

authorization export [flags]

Options

      --client-id string       optional client id
      --client-secret string   optional client secret
      --config string          config files
      --format string          json | yaml (default "json")
  -h, --help                   help for export
      --issuer-url string      optional issuer url
      --tenant string          optional tenant id

authorization healthcheck​

Check if acp is alive

authorization healthcheck [flags]

Options

  -h, --help            help for healthcheck
      --port int        the port (default 8443)
      --schema string   the schema (default "https")

authorization import​

Import tenant configuration using local database or via http. Do not provide issuer url to load into local database. Provide issuer url, client id, client secret to upload configuration via http.

authorization import [flags]

Options

      --client-id string       optional client id
      --client-secret string   optional client secret
      --config string          config files
      --format string          json | yaml (default "json")
  -h, --help                   help for import
      --input string           path to the json or yaml file with configuration
      --issuer-url string      optional issuer url
      --mode string            duplicate strategy: fail, ignore or update (default "ignore")
      --routing-mode string    optional, can be 'server' or 'tenant'
      --tenant-id string       optional, tenant id, required if using routing mode 'server' or 'tenant'

authorization jwks​

JWKs operations

Options

  -h, --help   help for jwks

authorization jwks convert​

Convert pem private and public keys to public and private jwks

authorization jwks convert -k cert-key.pem -c cert.pem -p jwks-public.json -j jwks-private.json [flags]

Options

  -c, --cert-path string           Certificate path
  -h, --help                       help for convert
  -k, --key-path string            Private key path
  -j, --private-jwks-path string   Private jwks output path
  -p, --public-jwks-path string    Public jwks output path

authorization server​

Server operations

Options

      --config string                   config files
      --consul-key string               read configuration from consul
      --create-default-tenant           create default tenant
      --create-default-vanity-domains   create default vanity domains
      --create-default-workspaces       create default workspaces
      --create-demo-workspace           create demo workspace
      --do-not-create-system-tenant     do not create system tenant
      --format string                   json | yaml (default "yaml")
  -h, --help                            help for server
      --init-timeout duration           init timeout (default 30s)
      --input string                    path to the json file with configuration
      --metrics                         enable prometheus metrics
      --metrics.port int                prometheus metrics port (default 9000)
      --mode string                     duplicate strategy: fail, ignore or update (default "ignore")
      --system.secret string            system client secret (default "n8HF35qzZkmsukHJzzz9LnN8m9Mf97uq")
      --vault-key string                read configuration from vault

authorization server start​

Start the server

authorization server start [flags]

Options

  -h, --help   help for start

authorization sql​

SQL operations

Options

  -h, --help   help for sql

authorization sql configure​

Configure SQL database

authorization sql configure [flags]

Options

  -h, --help   help for configure

authorization sql migrate​

Run sql migrations

authorization sql migrate [flags]

Options

      --config string       config files
      --consul-key string   read configuration from consul
  -h, --help                help for migrate
      --vault-key string    read configuration from vault

authorization sql retention​

Apply TimescaleDB retention policies from config (use --dry-run to preview)

authorization sql retention [flags]

Options

      --config string       config files
      --consul-key string   read configuration from consul
      --dry-run             report what would change without applying anything
  -h, --help                help for retention
      --vault-key string    read configuration from vault

authorization tenants​

Tenants operations

Options

      --config string   config files
  -h, --help            help for tenants

authorization tenants create​

Create tenant with default authorization servers and clients

authorization tenants create [flags]

Options

  -h, --help                      help for create
  -d, --tenant-id string          the id of a tenant
  -n, --tenant-name string        the name of a tenant (default "default")
  -u, --tenant-url string         the tenant base url
      --with-default-workspaces   with default workspaces

authorization version​

Display version

authorization version [flags]

Options

  -h, --help   help for version