Skip to Content
Operationsidentityctl

identityctl

identityctl is the Bash operator client distributed with lookandtry-identity. It authenticates through Authorization Code with PKCE using the public identityctl client in the control tenant.

export IDENTITYCTL_ISSUER='http://auth.identity.lookandtry.localhost:8084'
./identityctl login
./identityctl status

The CLI listens on a random loopback port, validates the callback and stores rotating tokens in an owner-only session file. It refreshes the access token when necessary.

./identityctl users imports TENANT_UUID 0
./identityctl users exports TENANT_UUID 0
./identityctl logout

Use a distinct IDENTITYCTL_SESSION_FILE for each environment. On a headless VPS, forward the chosen loopback callback port through SSH and set IDENTITYCTL_NO_BROWSER=true.

The CLI accepts IDENTITY_ADMIN_ACCESS_TOKEN for approved non-interactive automation. Do not put access or refresh tokens in process arguments.

FederationBulk user migration