Auth & account

`axhub auth`

Manage login, tokens, and account authentication.

`axhub auth idp`

Configure company SSO (OIDC) identity providers.

`axhub auth idp create`

Flag	Type	Description	Default
`--audience`	string	—	—
`--client-id`	string	—	—
`--client-secret`	string	—	—
`--dry-run`	boolean	—	`true`
`--enforced`	boolean	—	—
`--execute`	boolean	—	—
`--group-role`	string	—	—
`--issuer-url`	string	—	—
`--jit-provisioning`	boolean	—	—
`--name`	string	—	—
`--provider`	string	—	—
`--tenant`	string	—	—
`--tenant-resolution-strategy`	string	—	`DOMAIN`
`--user-type`	string	—	`INTERNAL`

`axhub auth idp disable`

Disable an identity provider.

Flag	Type	Description	Default
`--dry-run`	boolean	—	`true`
`--execute`	boolean	—	—
`--provider_id`	string	—	—
`--tenant`	string	—	—

`axhub auth idp enable`

Enable an identity provider.

Flag	Type	Description	Default
`--dry-run`	boolean	—	`true`
`--execute`	boolean	—	—
`--provider_id`	string	—	—
`--tenant`	string	—	—

`axhub auth idp list`

List registered identity providers.

Flag	Type	Description	Default
`--tenant`	string	—	—

`axhub auth idp providers`

List supported provider types.

Flag	Type	Description	Default
`--tenant`	string	—	—

`axhub auth idp test`

Test an identity provider configuration.

Flag	Type	Description	Default
`--provider_id`	string	—	—
`--tenant`	string	—	—

Flag	Type	Description	Default
`--device-code`	string	Resume an already-issued `AxHub` OAuth device code (env: `AXHUB_AUTH_DEVICE_CODE`)	—
`--force`	boolean	—	—
`--no-browser`	boolean	—	—
`--resume-last`	boolean	Resume the latest locally cached `AxHub` OAuth device flow for this profile	—
`--scopes`	string	—	—
`--tenant`	string	—	—

`axhub auth logout`

Log out and clear stored tokens.

Flag	Type	Description	Default
`--dry-run`	boolean	—	—

`axhub auth oauth`

Manage OAuth clients and consents.

`axhub auth oauth client`

`axhub auth oauth client create`

Flag	Type	Description	Default
`--app`	string	—	—
`--auth-method`	string	—	—
`--copy`	boolean	—	—
`--dry-run`	boolean	—	`true`
`--execute`	boolean	—	—
`--grant-type`	string	—	—
`--name`	string	—	—
`--redirect-uri`	string	—	—
`--scope`	string	—	—
`--type`	string	—	—

`axhub auth oauth client get`

Get OAuth client details.

Flag	Type	Description	Default
`--client_id`	string	—	—

Manage granted OAuth consents.

Revoke an OAuth consent.

Flag	Type	Description	Default
`--client_id`	string	—	—
`--dry-run`	boolean	—	`true`
`--execute`	boolean	—	—

`axhub auth oauth revoke`

Revoke an OAuth token.

Flag	Type	Description	Default
`--client-id`	string	—	`00000000-0000-4000-8000-000000000001`
`--client-secret`	string	—	—
`--client-secret-file`	string	—	—
`--dry-run`	boolean	—	`true`
`--execute`	boolean	—	—
`--token`	string	—	—
`--token-type-hint`	string	—	—

`axhub auth pat`

Manage personal access tokens (PATs).

`axhub auth pat issue`

Issue a new PAT.

Flag	Type	Description	Default
`--expires-in-days`	string	—	—
`--name`	string	—	—
`--no-save`	boolean	—	—
`--show-token`	boolean	—	—
`--use`	boolean	—	—

`axhub auth pat list`

List PATs.

Flag	Type	Description	Default
`--reconcile`	boolean	—	—

`axhub auth pat revoke`

Revoke a PAT.

Flag	Type	Description	Default
`--dry-run`	boolean	—	`true`
`--execute`	boolean	—	—
`--id`	string	—	—

`axhub auth pat rotate`

Rotate (reissue) a PAT.

Flag	Type	Description	Default
`--expires-in-days`	string	—	—
`--name`	string	—	—
`--show-token`	boolean	—	—

`axhub auth pat unset`

Unset the locally stored PAT.

(no options)

`axhub auth pat use`

Select the PAT to use.

Flag	Type	Description	Default
`--id`	string	—	—

`axhub auth pat whoami`

Show the current PAT's owner.

(no options)

`axhub auth refresh`

Refresh the access token.

Flag	Type	Description	Default
`--no-browser`	boolean	—	—
`--scopes`	string	—	—

`axhub auth status`

Show authentication status.

(no options)

`axhub auth whoami`

Show the current logged-in account.

(no options)

`axhub profile`

Manage CLI profiles (connection environments).

`axhub profile add`

Add a new profile.

Flag	Type	Description	Default
`--default`	boolean	—	—
`--endpoint`	string	—	—
`--name`	string	—	—

`axhub profile current`

Show the current profile.

(no options)

`axhub profile list`

List profiles.

(no options)

`axhub profile remove`

Remove a profile.

Flag	Type	Description	Default
`--name`	string	—	—

`axhub profile use`

Switch the active profile.

Flag	Type	Description	Default
`--name`	string	—	—

`axhub tenants`

View and manage companies (tenants).

`axhub tenants create`

Create a company.

Flag	Type	Description	Default
`--name`	string	—	—
`--slug`	string	—	—

`axhub tenants delete`

Delete a company.

Flag	Type	Description	Default
`--dry-run`	boolean	—	`true`
`--execute`	boolean	—	—
`--slug_or_id`	string	Tenant slug or UUID. Positional form matches `tenants get <slug>` / `apps delete <slug>` (the majority CLI shape). The legacy `--tenant <slug>` flag stays as a hidden alias so scripts that already use it keep working; passing both is a clap usage error (`conflicts_with`)	—
`--yes` `-y`	boolean	—	—

`axhub tenants get`

Get company details.

Flag	Type	Description	Default
`--slug_or_id`	string	—	—
`--tenant`	string	—	—

`axhub tenants icon`

Manage the company icon.

`axhub tenants icon clear`

Remove the company icon.

Flag	Type	Description	Default
`--dry-run`	boolean	—	`true`
`--execute`	boolean	—	—
`--tenant`	string	—	—

`axhub tenants icon set`

Set the company icon.

Flag	Type	Description	Default
`--file`	string	—	—
`--icon-url`	string	—	—
`--tenant`	string	—	—

`axhub tenants icon sign`

Issue a signed URL for icon upload.

Flag	Type	Description	Default
`--content-type`	string	MIME type of the file you'll PUT to the presigned URL. Allowed: image/png, image/jpeg, image/webp, image/gif, image/svg+xml	—
`--tenant`	string	—	—

`axhub tenants list`

List companies.

Flag	Type	Description	Default
`--all`	boolean	—	—

`axhub tenants update`

Update company details.

Flag	Type	Description	Default
`--description`	string	—	—
`--dry-run`	boolean	—	`true`
`--execute`	boolean	—	—
`--name`	string	—	—
`--slug_or_id`	string	Tenant slug or UUID. Mirrors `tenants get <slug>` / `tenants create --slug <slug>`. `--tenant <slug>` is kept as a hidden backward-compat alias; passing both is a clap usage error (`conflicts_with`) so destructive `tenants update` cannot silently target the wrong tenant — review of PR #196 (`.omc/ultraqa-live-prod/reviews/PR-196.md`) flagged the previous silent-positional-wins behaviour as a footgun	—

`axhub tenants whoami`

Show the active company.

Flag	Type	Description	Default
`--tenant`	string	—	—

`axhub config`

Manage CLI configuration.

`axhub config explain`

Explain the current config and where each value comes from.

(no options)

`axhub doctor`

Diagnose install, auth, and environment.

Flag	Type	Description	Default
`--args`	string	—	—
`--dry-run`	boolean	—	—
`--fix`	boolean	—	—
`--offline`	boolean	Skip the network reachability probe	—
`--send-report`	boolean	—	—

`axhub update`

Update the axhub CLI.

`axhub update apply`

Apply the update.

Flag	Type	Description	Default
`--dry-run`	boolean	Preview mode: print the apply plan without downloading or swapping. Defaults true — destructive paths require explicit `--execute` per `.claude/rules/product-development.md` "Destructive Command Safety"	`true`
`--execute`	boolean	Commit the apply plan: download, verify, and atomically swap the running binary. Conflicts with `--dry-run`	—
`--force`	boolean	Allow applying an older release that would otherwise be rejected by the downgrade gate. Does NOT bypass cosign verification — a signature/certificate failure still blocks the swap	—
`--yes` `-y`	boolean	Skip the post-confirm prompt during `--execute`. No effect in dry-run	—

`axhub update check`

Check for updates.

(no options)