shc auth create-service-client

mint a confidential service-account client for automation (terraform/CI)

Synopsis

Fetch-or-create a CONFIDENTIAL OIDC client in the master realm with the client_credentials grant enabled (all interactive flows disabled) — the credential terraform providers and CI pipelines authenticate with via shc auth login --client-credentials or a direct token grant. Because it lives in the master realm, every token it mints is SHC platform root (platform:manage is implicit for master-realm identities) — guard the secret accordingly.

The client secret is printed ONCE, on create; it is not retrievable later. Re-running against an existing client is an idempotent no-op that reports the client id only — pass —rotate-secret to regenerate (and print) a new secret, which immediately invalidates the old one.

The access-token lifespan is stamped per-client at create time (—token-lifespan, default 3600s): the realm default (60s) is unusable for automation runs. Requires platform:manage (local socket, or a logged-in platform admin).

shc auth create-service-client <name> [flags]

Examples

  shc auth create-service-client terraform
  shc auth create-service-client ci --token-lifespan 7200
  shc auth create-service-client terraform --rotate-secret

Options

  -h, --help                 help for create-service-client
      --rotate-secret        regenerate the secret of an existing client (invalidates the old secret) and print the new one
      --token-lifespan int   per-client access-token lifespan in seconds, stamped at create time (default 3600)

Options inherited from parent commands

      --config stringArray   extra YAML config file to layer on top of auto-discovered config; repeatable, later files win
  -d, --debug                enable debug mode (default: $SHC_DEBUG)
  -e, --environment string   environment name (default: $SHC_ENVIRONMENT)
      --exclude string       comma-separated dotted paths to drop
      --fields string        comma-separated columns/keys to show (and their order)
      --filter string        comma-separated dotted paths to keep (drops everything else)
  -o, --output string        output format: tty|text|json|yaml (default: $SHC_OUTPUT)
  -s, --stack string         stack name (default: $SHC_STACK)
  -t, --tenant string        tenant name (default: $SHC_TENANT)
  -v, --verbose              verbose output (default: $SHC_VERBOSE)

shc auth create-service-client