Step CLI

https://smallstep.com/docs/step-cli/
Admin
Step CLI is an easy-to-use command-line tool for building, operating, and automating Public Key...
Tokens:213,935
Snippets:2,361
Trust Score:9.4
Update:4 days ago
Show doc for...
Tokens:
Raw
### Install step on Windows via Winget

Source: https://smallstep.com/docs/step-cli/installation

Use Winget to install the step binary on Windows.

```powershell
winget install Smallstep.step
```

--------------------------------

### Install step on Windows via Scoop

Source: https://smallstep.com/docs/step-cli/installation

Use Scoop to add the smallstep bucket and install the step binary.

```powershell
scoop bucket add smallstep https://github.com/smallstep/scoop-bucket.git
scoop install smallstep/step
```

--------------------------------

### Install step on Wolfi

Source: https://smallstep.com/docs/step-cli/installation

Use apk to install the step package on Wolfi.

```bash
apk add step
```

--------------------------------

### Install step-cli on Debian/Ubuntu

Source: https://smallstep.com/docs/step-cli/installation

Add the Smallstep repository and install the step-cli package as root.

```bash
apt-get update && apt-get install -y --no-install-recommends curl gpg ca-certificates
curl -fsSL https://packages.smallstep.com/keys/apt/repo-signing-key.gpg -o /etc/apt/keyrings/smallstep.asc
cat << EOF > /etc/apt/sources.list.d/smallstep.sources
Types: deb
URIs: https://packages.smallstep.com/stable/debian
Suites: debs
Components: main
Signed-By: /etc/apt/keyrings/smallstep.asc
EOF
apt-get update && apt-get -y install step-cli
```

--------------------------------

### Install step-cli on RHEL/Fedora

Source: https://smallstep.com/docs/step-cli/installation

Configure the Smallstep repository and install the step-cli and step-ca packages as root.

```bash
cat <<EOT > /etc/yum.repos.d/smallstep.repo
[smallstep]
name=Smallstep
baseurl=https://packages.smallstep.com/stable/fedora/
enabled=1
repo_gpgcheck=0
gpgcheck=1
gpgkey=https://packages.smallstep.com/keys/smallstep-0x889B19391F774443.gpg
EOT
dnf makecache && dnf install -y step-cli step-ca
```

--------------------------------

### Bootstrap and install root certificate

Source: https://smallstep.com/docs/step-cli/reference/ca/bootstrap

Bootstraps and installs the root certificate into the system's default trust store using the --install flag.

```bash
$ step ca bootstrap --ca-url https://ca.example.com \
  --fingerprint d9d0978692f1c7cc791f5c343ce98771900721405e834cd27b9502cc719f5097 \
  --install
```

--------------------------------

### Example: step crypto key inspect priv.pem

Source: https://smallstep.com/docs/step-cli/reference/crypto/key/inspect

Prints details of the given key file. The example uses `priv.pem` as the key file.

```bash
$ step crypto key inspect priv.pem
```

--------------------------------

### Example: step ca provisioner list

Source: https://smallstep.com/docs/step-cli/reference/ca/provisioner/list

Prints a JSON list with active provisioners.

```bash
$ step ca provisioner list
```

--------------------------------

### Usage: step certificate install

Source: https://smallstep.com/docs/step-cli/reference/certificate/install

Shows the command syntax for installing a root certificate. The `crt-file` argument is the root certificate to install. Options include `--prefix`, `--all`, `--java`, `--firefox`, and `--no-system`.

```bash
step certificate install <crt-file>
[--prefix=<name>] [--all]
[--java] [--firefox] [--no-system]
```

--------------------------------

### KMS configuration examples

Source: https://smallstep.com/docs/step-cli/reference/ca/sign

Examples of URI formats for configuring various cloud KMS or HSM providers when using the --kms flag.

```text
yubikey:pin-value=123456
pkcs11:module-path=/usr/lib/softhsm/libsofthsm2.so;token=smallstep?pin-value=pass
tpmkms:name=my-key;device=/dev/tpmrm0
awskms:region=us-east-1
azurekms:client-id=fooo;client-secret=bar;tenant-id=9de53416-4431-4181-7a8b-23af3EXAMPLE
```

--------------------------------

### Start an HTTP file server

Source: https://smallstep.com/docs/step-cli/reference/fileserver

Starts an HTTP file server on the specified address and port.

```bash
$ step fileserver --address :8080 /path/to/web-root
```

--------------------------------

### Install root certificate in Java and system trust stores

Source: https://smallstep.com/docs/step-cli/reference/certificate/install

Installs the root certificate in Java's key store and the system's default trust store using the `--java` flag.

```bash
$ step certificate install --java root-ca.pem
```

--------------------------------

### Start an HTTPS file server

Source: https://smallstep.com/docs/step-cli/reference/fileserver

Generates a certificate and starts an HTTPS file server on the specified address and port.

```bash
$ step ca certificate 127.0.0.1 localhost.crt localhost.key
...
$ step fileserver --address 127.0.0.1:8443 \
  --cert localhost.crt --key localhost.key /path/to/web-root
```

--------------------------------

### Install step on macOS via Homebrew

Source: https://smallstep.com/docs/step-cli/installation

Use Homebrew to install the step binary on macOS.

```bash
brew install step
```

--------------------------------

### Install step on Windows manually

Source: https://smallstep.com/docs/step-cli/installation

Download and extract the Windows binary using PowerShell.

```powershell
curl.exe -LO https://dl.smallstep.com/cli/docs-cli-install/latest/step_windows_amd64.zip
Expand-Archive -LiteralPath .\step_windows_amd64.zip -DestinationPath .
step_windows_amd64\bin\step.exe version
```

--------------------------------

### step context current example

Source: https://smallstep.com/docs/step-cli/reference/context/current

Example of running `step context current` without options, displaying the current context name.

```bash
$ step context current
test-ca
```

--------------------------------

### Install step-cli on Alpine Linux

Source: https://smallstep.com/docs/step-cli/installation

Use apk to install the community-maintained step-cli package.

```bash
apk add step-cli
```

--------------------------------

### Start an HTTPS file server with client certificate requirements

Source: https://smallstep.com/docs/step-cli/reference/fileserver

Starts an HTTPS file server that requires client certificates for authentication, using the root CA certificate from the step path.

```bash
$ step fileserver --cert localhost.crt --key localhost.key \
  --roots $(step path)/certs/root_ca.crt /path/to/web-root
```

--------------------------------

### Install root certificate in all supported trust stores

Source: https://smallstep.com/docs/step-cli/reference/certificate/install

Installs the root certificate in Firefox's, Java's, and the system's default trust store using the `--all` flag.

```bash
$ step certificate install --all root-ca.pem
```

--------------------------------

### Test Step CLI installation

Source: https://smallstep.com/docs/step-cli/installation

Use the step certificate inspect command to verify that the CLI is correctly installed and can communicate with a remote server.

```bash
$ step certificate inspect https://smallstep.com
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 326381749415081530968054238478851085504954 (0x3bf265673332db2d0c70e48a163fb7d11ba)
    Signature Algorithm: SHA256-RSA
        Issuer: C=US,O=Let's Encrypt,CN=Let's Encrypt Authority X3
        Validity
            Not Before: Feb 8 13:07:44 2019 UTC
            Not After : May 9 13:07:44 2019 UTC
        Subject: CN=smallstep.com
[...]
```

--------------------------------

### Install step-cli on Arch Linux

Source: https://smallstep.com/docs/step-cli/installation

Install the community-maintained step-cli package and create a symlink for the step command.

```bash
sudo pacman -S step-cli
```

```bash
sudo ln -s /usr/bin/step-cli /usr/local/bin/step
```

--------------------------------

### step crypto nacl auth verify examples

Source: https://smallstep.com/docs/step-cli/reference/crypto/nacl/auth

Example of verifying a digest with the verify subcommand. First variant prompts for text; second pipes a file. Output is 'ok' when verification succeeds.

```bash
$ step crypto nacl auth verify auth.key 33c54aeb54077808fcfccadcd2f01971b120e314dffa61516b0738b74fdc8ff1
Please enter text to verify: 
ok

$ cat message.txt | step crypto nacl auth verify auth.key 33c54aeb54077808fcfccadcd2f01971b120e314dffa61516b0738b74fdc8ff1
ok
```

--------------------------------

### step context current --json example

Source: https://smallstep.com/docs/step-cli/reference/context/current

Example of running `step context current --json`, returning stringified JSON with context attributes.

```bash
$ step context current --json
{"name":"test-ca","authority":"internal.ca.smallstep.com","profile":"test-ca"}
```

--------------------------------

### YubiKey KMS URI example

Source: https://smallstep.com/docs/step-cli/reference/ca/token

An example of a YubiKey KMS URI configuration string used with the --kms flag.

```text
yubikey:pin-value=123456
```

--------------------------------

### step fileserver

Source: https://smallstep.com/docs/step-cli/reference/fileserver

Starts an HTTP(S) server that serves the contents of a directory. This command is experimental and intended for test purposes.

```APIDOC
## step fileserver

### Description
Starts an HTTP(S) server that serves the contents of a file system. If the server is running using certificates, sending the HUP signal will reload the certificates. This command is experimental and only intended for test purposes.

### Usage
step fileserver <dir> [--address=<address>] [--cert=<file>] [--key=<file>] [--roots=<file>] [--pidfile=<file>]

### Positional Arguments
- **dir** (string) - Required - The directory used as root for the HTTP file server.

### Options
- **--address** (string) - Optional - The TCP address to listen on (e.g. ":8443").
- **--cert** (string) - Optional - The file containing the TLS certificate to use.
- **--key** (string) - Optional - The file containing the key corresponding to the certificate.
- **--roots** (string) - Optional - The file containing the root certificate(s) that will be used to verify the client certificates.
- **--pidfile** (string) - Optional - The path to the file to write the process ID.

### Examples
Start an HTTP file server on port 8080:
```
$ step fileserver --address :8080 /path/to/web-root
```

Start an HTTPS file server on 127.0.0.1:8443:
```
$ step ca certificate 127.0.0.1 localhost.crt localhost.key
...
$ step fileserver --address 127.0.0.1:8443 \
  --cert localhost.crt --key localhost.key /path/to/web-root
```

Start an HTTPS file server on a random port and require client certificates:
```
$ step fileserver --cert localhost.crt --key localhost.key \
  --roots $(step path)/certs/root_ca.crt /path/to/web-root
```
```

--------------------------------

### step certificate install

Source: https://smallstep.com/docs/step-cli/reference/certificate/install

Installs a root certificate in the supported trust stores. Supports Java and Firefox trust stores via flags.

```APIDOC
## step certificate install

### Description
Installs a root certificate in the supported trust stores. Java's and Firefox's trust stores are also supported via the respective flags.

### Usage

step certificate install <crt-file> [--prefix=<name>] [--all] [--java] [--firefox] [--no-system]


### Positional Arguments
- **crt-file** (string) - Required - Root certificate to install in the specified trust stores.

### Options
- **--prefix**=<name> (string) - Optional - The prefix used to name the CA in the trust store. Defaults to the certificate common name.
- **--java** (boolean) - Optional - Install on the Java key store.
- **--firefox** (boolean) - Optional - Install on the Firefox NSS security database.
- **--no-system** (boolean) - Optional - Disables the install on the system's default trust store.
- **--all** (boolean) - Optional - Install in Firefox's, Java's, and the system's default trust store.

### Examples
Install a root certificate in the system's default trust store:

$ step certificate install root-ca.pem


Install a root certificate in all the supported trust stores:

$ step certificate install --all root-ca.pem


Install a root certificate in Firefox's and the system's default trust store:

$ step certificate install --firefox root-ca.pem


Install a root certificate in Java's and the system's default trust store:

$ step certificate install --java root-ca.pem


Install a root certificate in Firefox's and Java's trust store, but not in the system's default trust store:

$ step certificate install --firefox --java --no-system root-ca.pem

```

--------------------------------

### step certificate fingerprint example

Source: https://smallstep.com/docs/step-cli/reference/ca/init

Example command to get the root certificate fingerprint, used with the --issuer-fingerprint flag.

```bash
$ step certificate fingerprint root_ca.crt
4fe5f5ef09e95c803fdcb80b8cf511e2a885eb86f3ce74e3e90e62fa3faf1531
```

--------------------------------

### Get SSH Certificate Fingerprint

Source: https://smallstep.com/docs/step-cli/basic-crypto-operations

Use `step ssh fingerprint` to get the fingerprint of an SSH certificate or public key. The example shows the output for the same certificate, displaying the SHA256 fingerprint.

```bash
$ step ssh fingerprint < mycert.crt
256 SHA256:CQ6+r7ccb/wqoWK1ror10c44nNvvYXp2mgbPrsTmCbw c (ECDSA-CERT)
```

--------------------------------

### Allow all URI subdomains of example.com at provisioner level

Source: https://smallstep.com/docs/step-cli/reference/ca/policy/acme/x509/deny/uri

Command to allow all URI subdomains of "example.com" in X.509 certificates on provisioner level.

```bash
$ step ca policy provisioner x509 allow uri "*example.com" --provisioner my_provisioner
```

--------------------------------

### Get public key from a CSR and save to file

Source: https://smallstep.com/docs/step-cli/reference/certificate/key

Example command that extracts the public key from `certificate.csr` and writes it to `key.pem` using the `--out` option.

```bash
$ step certificate key certificate.csr --out key.pem
```

--------------------------------

### Get public key from a certificate

Source: https://smallstep.com/docs/step-cli/reference/certificate/key

Example command that prints the public key embedded in `certificate.crt` to standard output, followed by the resulting PEM-encoded public key.

```bash
$ step certificate key certificate.crt
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEio9DLyuglMxakS3w00DUKdGbeXXB
2Mfg6tVofeXYan9RbvftZufiypIAVqGZqO7CR9EbkoyHb/7GcKQa5HZ9rA==
-----END PUBLIC KEY-----
```

--------------------------------

### Create a Certificate Authority with Let's Encrypt

Source: https://smallstep.com/docs/step-cli/basic-crypto-operations

Requests an SSL certificate from Let's Encrypt, starts a standalone HTTP server on port 80 to serve the http-01 challenge, and saves the certificate and private key to example.com.crt and example.com.key. Use --webroot <path> to place the token file instead of running a server. For a dry run, use the staging server URL https://acme-staging-v02.api.letsencrypt.org/directory.

```shell
step ca certificate example.com example.com.crt example.com.key
```

--------------------------------

### Allow DNS subdomains on provisioner level

Source: https://smallstep.com/docs/step-cli/reference/ca/policy/acme/x509/allow/dns

Adds all DNS subdomains of "example.com" to the allowed DNS names in X.509 certificates for the specified provisioner.

```shell
$ step ca policy provisioner x509 allow dns "*example.com" --provisioner my_provisioner
```

--------------------------------

### Usage: step ca provisioner list

Source: https://smallstep.com/docs/step-cli/reference/ca/provisioner/list

Shows the command syntax with optional flags for CA URL, root certificate, and context.

```bash
step ca provisioner list
[--ca-url=<uri>] [--root=<file>] [--context=<name>]
```

--------------------------------

### Create a JWK provisioner with existing keys

Source: https://smallstep.com/docs/step-cli/reference/ca/provisioner/add

Creates a JWK provisioner using pre-existing public and private key files.

```bash
step ca provisioner add jane@doe.com --type JWK --public-key jwk.pub --private-key jwk.priv
```

--------------------------------

### Install root certificate in Firefox and Java but not system

Source: https://smallstep.com/docs/step-cli/reference/certificate/install

Installs the root certificate in Firefox's and Java's trust stores, but disables installation in the system's default trust store using the `--no-system` flag.

```bash
$ step certificate install --firefox --java --no-system root-ca.pem
```

--------------------------------

### Package a certificate and private key

Source: https://smallstep.com/docs/step-cli/reference/certificate/p12

Creates a .p12 file containing the specified certificate and private key.

```bash
$ step certificate p12 foo.p12 foo.crt foo.key
```

--------------------------------

### step ca init usage

Source: https://smallstep.com/docs/step-cli/reference/ca/init

Shows the command-line usage for step ca init, including all available flags and their placeholders.

```bash
step ca init
[--root=<file>] [--key=<file>] [--key-password-file=<file>] [--pki] [--ssh]
[--helm] [--deployment-type=<name>] [--name=<name>]
[--dns=<dns>] [--address=<address>] [--provisioner=<name>]
[--admin-subject=<string>] [--provisioner-password-file=<file>]
[--password-file=<file>] [--ra=<type>] [--kms=<type>]
[--with-ca-url=<url>] [--no-db] [--remote-management]
[--acme] [--context=<name>] [--profile=<name>] [--authority=<name>]
```

--------------------------------

### Example JWE compact serialization output

Source: https://smallstep.com/docs/step-cli/reference/crypto/jwe

An example of a JWE in compact serialization, with line breaks for display purposes.

```text
eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZHQ00ifQ.
OKOawDo13gRp2ojaHV7LFpZcgV7T6DVZKTyKOMTYUmKoTCVJRgckCL9kiMT03JGe
ipsEdY3mx_etLbbWSrFr05kLzcSr4qKAq7YN7e9jwQRb23nfa6c9d-StnImGyFDb
Sv04uVuxIp5Zms1gNxKKK2Da14B8S4rzVRltdYwam_lDp5XnZAYpQdb76FdIKLaV
mqgfwX7XWRxv2322i-vDxRfqNzo_tETKzpVLzfiwQyeyPGLBIO56YJ7eObdv0je8
1860ppamavo35UgoRdbYaBcoh9QcfylQr66oc6vFWXRcZ_ZT2LawVCWTIy3brGPi
6UklfCpIMfIjf7iGdXKHzg.
48V1_ALb6US04U3b.
5eym8TW_c8SuK0ltJ3rpYIzOeDQz7TALvtu6UG9oMo4vpzs9tX_EFShS8iB7j6ji
SdiwkIr3ajwQzaBtQD_A.
XFBoMYUZodetZdvTiFvSkQ
```

--------------------------------

### Allow all email addresses for example.com domain in X.509 certificates on provisioner level

Source: https://smallstep.com/docs/step-cli/reference/ca/policy/authority/ssh/host/deny/email

Adds the domain @example.com to the allow policy for X.509 certificates at the provisioner level, specifying the provisioner name.

```shell
$ step ca policy provisioner x509 allow email @example.com --provisioner my_provisioner
```

--------------------------------

### Create an X5C provisioner

Source: https://smallstep.com/docs/step-cli/reference/ca/provisioner/add

Creates an X5C provisioner using the specified root certificate file.

```bash
step ca provisioner add x5c --type X5C --x5c-roots x5c_ca.crt
```

--------------------------------

### Configure CA URL and root in the environment

Source: https://smallstep.com/docs/step-cli/reference/ca

Bootstraps the environment by configuring the CA URL and fingerprint, then shows the resulting defaults.json file. The root path in the output will reflect your user's home directory.

```shell
$ step ca bootstrap \
  --ca-url https://ca.smallstep.com \
  --fingerprint 0d7d3834cf187726cf331c40a31aa7ef6b29ba4df601416c9788f6ee01058cf3
$ cat $STEPPATH/config/defaults.json
{
  "ca-url": "https://ca.smallstep.com",
  "fingerprint": "0d7d3834cf187726cf331c40a31aa7ef6b29ba4df601416c9788f6ee01058cf3",
  "root": "/home/user/.step/certs/root_ca.crt"
}
```

--------------------------------

### Install root certificate in system trust store

Source: https://smallstep.com/docs/step-cli/reference/certificate/install

Installs the root certificate in the system's default trust store. This is the default behavior when no trust store flags are specified.

```bash
$ step certificate install root-ca.pem
```

--------------------------------

### Retrieve encrypted private JWK example

Source: https://smallstep.com/docs/step-cli/reference/ca/provisioner/jwe-key

An example command showing how to retrieve the encrypted private JWK for a specific key-id using a specified CA URL and root certificate.

```bash
$ step ca provisioner jwe-key 1234 --ca-url https://127.0.0.1 --root ./root.crt
```

--------------------------------

### step ca root - get root fingerprint

Source: https://smallstep.com/docs/step-cli/reference/ca/root

Gets the root fingerprint from a root certificate file. The output shows the SHA-256 fingerprint that is later used with the --fingerprint flag.

```shell
$ step certificate fingerprint /path/to/root_ca.crt
0d7d3834cf187726cf331c40a31aa7ef6b29ba4df601416c9788f6ee01058cf3
```

--------------------------------

### Create an ACME provisioner for device attestation

Source: https://smallstep.com/docs/step-cli/reference/ca/provisioner/add

Creates an ACME provisioner configured for device attestation using the device-attest-01 challenge.

```bash
step ca provisioner add attestation --type ACME --challenge device-attest-01
```

--------------------------------

### Add regular admin

Source: https://smallstep.com/docs/step-cli/reference/ca/admin/add

Adds an admin with the subject 'max@smallstep.com' using the 'google' provisioner.

```bash
$ step ca admin add max@smallstep.com google
```

--------------------------------

### Install root certificate in Firefox and system trust stores

Source: https://smallstep.com/docs/step-cli/reference/certificate/install

Installs the root certificate in Firefox's NSS security database and the system's default trust store using the `--firefox` flag.

```bash
$ step certificate install --firefox root-ca.pem
```

--------------------------------

### Create an ACME provisioner

Source: https://smallstep.com/docs/step-cli/reference/ca/provisioner/add

Creates a basic ACME provisioner.

```bash
step ca provisioner add acme --type ACME
```

--------------------------------

### step crypto nacl auth digest examples

Source: https://smallstep.com/docs/step-cli/reference/crypto/nacl/auth

Example of generating a 32-byte digest (HMAC-SHA-512-256) with the digest subcommand. First variant prompts for text; second pipes a file. Output is a 64-character hex digest.

```bash
$ step crypto nacl auth digest auth.key
Please enter text to authenticate: 
33c54aeb54077808fcfccadcd2f01971b120e314dffa61516b0738b74fdc8ff1

$ cat message.txt | step crypto nacl auth digest auth.key
33c54aeb54077808fcfccadcd2f01971b120e314dffa61516b0738b74fdc8ff1
```

--------------------------------

### Bootstrap using CA URL and fingerprint

Source: https://smallstep.com/docs/step-cli/reference/ca/bootstrap

Bootstraps the environment by specifying the CA URL and root certificate fingerprint.

```bash
$ step ca bootstrap --ca-url https://ca.example.com \
  --fingerprint d9d0978692f1c7cc791f5c343ce98771900721405e834cd27b9502cc719f5097
```

--------------------------------

### Create a new certificate using a token

Source: https://smallstep.com/docs/step-cli/reference/ca

Creates a new certificate for internal.example.com by generating a token first)Skip; the certificate and key are written to internal.crt and internal.key.

```shell
$ TOKEN=$(step ca token internal.example.com)
$ step ca certificate internal.example.com internal.crt internal.key \
  --token $TOKEN --ca-url https://ca.smallstep.com --root root_ca.crt
```

--------------------------------

### Step crl inspect command and examples

Source: https://smallstep.com/docs/step-cli/reference/crl/inspect

The general usage of the step crl inspect command, followed by examples for inspecting a CRL, validating with a CA file, formatting output as JSON, and extracting CRL from a URL.

```bash
step crl inspect <file|url>
```

```bash
$ step crl inspect --insecure http://ca.example.com/crls/exampleca.crl
```

```bash
$ step crl inspect --ca ca.crt exampleca.crl
```

```bash
$ step crl inspect --insecure --format json exampleca.crl
```

```bash
$ step crl inspect --from https://www.google.com
```

--------------------------------

### Create a JWK provisioner with custom config path

Source: https://smallstep.com/docs/step-cli/reference/ca/provisioner/add

Creates a JWK provisioner and explicitly selects the configuration file to update.

```bash
step ca provisioner add cicd --type JWK --create --ca-config /path/to/ca.json
```

--------------------------------

### KMS URI examples

Source: https://smallstep.com/docs/step-cli/reference/ca/certificate

Examples of KMS URIs for YubiKey, PKCS #11, TPM 2.0, AWS KMS, and Azure Key Vault. These URIs are used with the --kms flag to configure a KMS or HSM.

```text
yubikey:pin-value=123456
pkcs11:module-path=/usr/lib/softhsm/libsofthsm2.so;token=smallstep?pin-value=pass
tpmkms:name=my-key;device=/dev/tpmrm0
awskms:region=us-east-1
azurekms:client-id=fooo;client-secret=bar;tenant-id=9de53416-4431-4181-7a8b-23af3EXAMPLE
```

--------------------------------

### step oauth --bare

Source: https://smallstep.com/docs/step-cli/reference/oauth

Get just the access token.

```shell
$ step oauth --bare
```

--------------------------------

### step oauth --oidc --bare

Source: https://smallstep.com/docs/step-cli/reference/oauth

Get just the OIDC token.

```shell
$ step oauth --oidc --bare
```

--------------------------------

### Apply configuration templates on host

Source: https://smallstep.com/docs/step-cli/reference/ssh/config

Applies configuration templates for a host system.

```bash
$ step ssh config --host
```

--------------------------------

### Inspect a CRL

Source: https://smallstep.com/docs/step-cli/reference/crl

Example command to inspect a certificate revocation list from a specified URL.

```bash
$ step crl inspect http://ca.example.com/crls/exampleca.crl
```

--------------------------------

### Get a new token using simple offline mode

Source: https://smallstep.com/docs/step-cli/reference/ca/token

Requires configuration files, certificates, and keys created with step ca init.

```shell
$ step ca token internal.example.com --offline
```

--------------------------------

### Allow all local parts for example.com domain in SSH user certificates on provisioner level

Source: https://smallstep.com/docs/step-cli/reference/ca/policy/authority/ssh/host/deny/email

Adds the domain @example.com to the allow policy for SSH user certificates at the provisioner level, specifying the provisioner name.

```shell
$ step ca policy provisioner ssh user allow email @example.com --provisioner my_provisioner
```
Tokens:
Raw