@oidfed/cli

Command-line interface for inspecting, validating, and debugging OpenID Federation deployments — resolve trust chains, decode entity statements, verify signatures, and more.

Implements command-line inspection and debugging utilities for the final OpenID Federation 1.0 / 1.1 specifications, and Extended Subordinate Listing 1.0 (tracks draft-02).

Install

Requires Node.js ≥ 22 or Bun or Deno.

Choose the command for your preferred JavaScript package manager or runtime:

# npm (global install)
npm install -g @oidfed/cli

# pnpm (global install)
pnpm add -g @oidfed/cli

# yarn (global install)
yarn global add @oidfed/cli

# bun (global install)
bun add -g @oidfed/cli

# Deno (global install)
deno install --allow-read --allow-net --global npm:@oidfed/cli

Alternatively, run commands directly without installation:

# npx
npx @oidfed/cli --help

# bunx
bunx @oidfed/cli --help

Installs two equivalent binaries: oidfed and openidfed.

Usage

You can try the following commands immediately against @oidfed's live reference deployment (fed.oidfed.com):

# Fetch an entity configuration
oidfed entity https://ta.single.fed.oidfed.com

# Resolve and validate a trust chain
oidfed chain https://rp1.single.fed.oidfed.com

# Verify a JWT signature
oidfed verify eyJ... --entity-id https://rp1.single.fed.oidfed.com

# Check trust mark status
oidfed trust-mark-status https://ta.single.fed.oidfed.com --trust-mark eyJ...

# Machine-readable output (decode the JWT first so `jq` sees the payload)
oidfed entity https://ta.single.fed.oidfed.com --decode --json | jq '.metadata'

# Generate a signing key
oidfed keygen --algorithm ES256

# Health check
oidfed health https://ta.single.fed.oidfed.com

# Page through a large federation with extended listing
oidfed list-extended https://ta.single.fed.oidfed.com \
  --limit 50 --audit-timestamps \
  --claims subordinate_statement --claims trust_marks

Documentation

For a complete CLI command reference, configuration parameters, global flags, and debugging workflows, see the docs/tools/cli.md file.

License

Apache-2.0 — see NOTICE for attribution.