Configuration settings reference

activeProfile

String

The name of the currently active configuration profile. Ping CLI reads configuration from the profile block matching this name.

description

String

A user-defined text description for the configuration profile.

detailedExitCode

--detailed-exitcode / -D

PINGCLI_DETAILED_EXITCODE

Boolean

Enable detailed exit code output. (default false) 0 - Ping CLI command succeeded with no errors or warnings. 1 - Ping CLI command failed with errors. 2 - Ping CLI command succeeded with warnings.

noColor

--no-color

PINGCLI_NO_COLOR

Boolean

Disable text output in color. (default false)

outputFormat

--output-format / -O

PINGCLI_OUTPUT_FORMAT

String (Enum)

Specify the console output format. (default text) Options are: json, ndjson, ndjson-wrapped, text.

service.pingfederate.adminAPIPath

--pingfederate-admin-api-path

PINGCLI_PINGFEDERATE_ADMIN_API_PATH

String

The PingFederate API URL path used to communicate with PingFederate’s admin API. (default /pf-admin-api/v1)

service.pingfederate.authentication.accessTokenAuth.accessToken

--pingfederate-access-token

PINGCLI_PINGFEDERATE_ACCESS_TOKEN

String

The PingFederate access token used to authenticate to the PingFederate admin API when using a custom OAuth 2.0 token method.

service.pingfederate.authentication.basicAuth.password

--pingfederate-password

PINGCLI_PINGFEDERATE_PASSWORD

String

The PingFederate password used to authenticate to the PingFederate admin API when using basic authentication.

service.pingfederate.authentication.basicAuth.username

--pingfederate-username

PINGCLI_PINGFEDERATE_USERNAME

String

The PingFederate username used to authenticate to the PingFederate admin API when using basic authentication. Example: 'administrator'

service.pingfederate.authentication.oauth.clientCredentials.clientID

--pingfederate-client-id

PINGCLI_PINGFEDERATE_CLIENT_ID

String

The PingFederate client ID used to authenticate to the PingFederate admin API when using the client credentials authentication type.

service.pingfederate.authentication.oauth.clientCredentials.clientID

--pingfederate-oauth-client-id

PINGCLI_PINGFEDERATE_OAUTH_CLIENT_ID

String

The PingFederate OAuth client ID used when the authentication type is 'oauth' with a client credentials grant type.

service.pingfederate.authentication.oauth.clientCredentials.clientSecret

--pingfederate-client-secret

PINGCLI_PINGFEDERATE_CLIENT_SECRET

String

The PingFederate client secret used to authenticate to the PingFederate admin API when using the client credentials authentication type.

service.pingfederate.authentication.oauth.clientCredentials.clientSecret

--pingfederate-oauth-client-secret

PINGCLI_PINGFEDERATE_OAUTH_CLIENT_SECRET

String

The PingFederate OAuth client secret used when the authentication type is 'oauth' with a client credentials grant type.

service.pingfederate.authentication.oauth.clientCredentials.scopes

--pingfederate-oauth-scopes

PINGCLI_PINGFEDERATE_OAUTH_SCOPES

String Array

The PingFederate OAuth scopes used when the authentication type is 'oauth' with a client credentials grant type. (default []) Accepts a comma-separated string to delimit multiple scopes.

service.pingfederate.authentication.oauth.clientCredentials.scopes

--pingfederate-scopes

PINGCLI_PINGFEDERATE_SCOPES

String Array

The PingFederate scopes used to authenticate to the PingFederate admin API when using the client credentials authentication type. (default []) Accepts a comma-separated string to delimit multiple scopes. Example: 'openid,profile'

service.pingfederate.authentication.oauth.clientCredentials.tokenURL

--pingfederate-oauth-token-url

PINGCLI_PINGFEDERATE_OAUTH_TOKEN_URL

String

The PingFederate OAuth token URL used when the authentication type is 'oauth' with a client credentials grant type.

service.pingfederate.authentication.oauth.clientCredentials.tokenURL

--pingfederate-token-url

PINGCLI_PINGFEDERATE_TOKEN_URL

String

The PingFederate token URL used to authenticate to the PingFederate admin API when using the client credentials authentication type.

service.pingfederate.authentication.oauth.grantType

--pingfederate-authentication-oauth-grant-type

PINGCLI_PINGFEDERATE_AUTHENTICATION_OAUTH_GRANT_TYPE

String (Enum)

The authentication type to use when connecting to the PingFederate admin API. Options are: client_credentials. Example: 'client_credentials'

service.pingfederate.authentication.type

--pingfederate-authentication-type

PINGCLI_PINGFEDERATE_AUTHENTICATION_TYPE

String (Enum)

The authentication type to use when connecting to the PingFederate admin API. Options are: accessTokenAuth, basicAuth, clientCredentialsAuth, oauth. Example: 'oauth'

service.pingfederate.caCertificatePemFiles

--pingfederate-ca-certificate-pem-files

PINGCLI_PINGFEDERATE_CA_CERTIFICATE_PEM_FILES

String Array

Relative or full paths to PEM-encoded certificate files to be trusted as root CAs when connecting to the PingFederate server over HTTPS. (default []) Accepts a comma-separated string to delimit multiple PEM files.

service.pingfederate.enabled

PINGCLI_PINGFEDERATE_ENABLED

Boolean

Explicitly enable or disable the PingFederate service.

service.pingfederate.httpsHost

--pingfederate-https-host

PINGCLI_PINGFEDERATE_HTTPS_HOST

String

The PingFederate HTTPS host used to communicate with PingFederate’s admin API. Example: 'https://pingfederate-admin.bxretail.org'

service.pingfederate.insecureTrustAllTLS

--pingfederate-insecure-trust-all-tls

PINGCLI_PINGFEDERATE_INSECURE_TRUST_ALL_TLS

Boolean

Trust any certificate when connecting to the PingFederate server admin API. (default false) This is insecure and shouldn’t be enabled outside of testing.

service.pingfederate.softwareVersion

--pingfederate-software-version

PINGCLI_PINGFEDERATE_SOFTWARE_VERSION

String

The PingFederate software version to use when connecting to the PingFederate admin API. This is used to select the correct SDK version for authentication. After successful authentication, the actual running version is auto-detected from the API. (default 13.0) Example: '13.0'

service.pingfederate.xBypassExternalValidationHeader

--pingfederate-x-bypass-external-validation-header

PINGCLI_PINGFEDERATE_X_BYPASS_EXTERNAL_VALIDATION_HEADER

Boolean

Bypass connection tests when configuring PingFederate (the X-BypassExternalValidation header when using PingFederate’s admin API). (default false)

service.pingone.authentication.authorizationCode.clientID

--pingone-authorization-code-client-id

PINGONE_AUTHORIZATION_CODE_CLIENT_ID

String (UUID Format)

The authorization code client ID used to authenticate to the PingOne management API.

service.pingone.authentication.authorizationCode.redirectUri.path

String

The custom redirect URI path for the local redirect web server during authorization code authentication.

service.pingone.authentication.authorizationCode.redirectUri.port

String

The custom port for the local redirect web server during authorization code authentication.

service.pingone.authentication.authorizationCode.scopes

--pingone-authorization-code-scopes

PINGONE_AUTHORIZATION_CODE_SCOPES

String Array

The authorization code scopes used to authenticate to the PingOne management API.

service.pingone.authentication.clientCredentials.clientID

--pingone-client-credentials-client-id

PINGONE_CLIENT_CREDENTIALS_CLIENT_ID

String (UUID Format)

The client credentials client ID used to authenticate to the PingOne management API.

service.pingone.authentication.clientCredentials.clientSecret

--pingone-client-credentials-client-secret

PINGONE_CLIENT_CREDENTIALS_CLIENT_SECRET

String

The client credentials client secret used to authenticate to the PingOne management API.

service.pingone.authentication.clientCredentials.scopes

--pingone-client-credentials-scopes

PINGONE_CLIENT_CREDENTIALS_SCOPES

String Array

The client credentials scopes used to authenticate to the PingOne management API.

service.pingone.authentication.deviceCode.clientID

--pingone-device-code-client-id

PINGONE_DEVICE_CODE_CLIENT_ID

String (UUID Format)

The device code client ID used to authenticate to the PingOne management API.

service.pingone.authentication.deviceCode.scopes

--pingone-device-code-scopes

PINGONE_DEVICE_CODE_SCOPES

String Array

The device code scopes used to authenticate to the PingOne management API.

service.pingone.authentication.grantType

--pingone-authentication-oauth-grant-type

PINGONE_AUTH_GRANT_TYPE

String (Enum)

The authorization grant type to use to authenticate to the PingOne management API. (default client_credentials) Options are: authorization_code, client_credentials, device_code.

service.pingone.enabled

PINGCLI_PINGONE_ENABLED

Boolean

Explicitly enable or disable the PingOne service.

service.pingone.endpoint.customDomain

--pingone-custom-domain

PINGONE_CUSTOM_DOMAIN

String

The custom domain of the PingOne tenant. Example: 'auth.bxretail.org'

service.pingone.endpoint.environmentID

--pingone-environment-id

PINGONE_ENVIRONMENT_ID

String (UUID Format)

The ID of the PingOne environment to use for authentication (used by all auth types).

service.pingone.endpoint.rootDomain

--pingone-root-domain

PINGONE_ROOT_DOMAIN

String (Enum)

The root domain of the PingOne tenant. Options are: pingone.asia, pingone.ca, pingone.com, pingone.com.au, pingone.eu, pingone.sg. Example: 'pingone.com'

auth.storage.type

--storage-type

PINGCLI_AUTH_STORAGE_TYPE

String (Enum)

Auth token storage (default: secure_local) secure_local - Use OS keychain (default) file_system - Store tokens in ~/.Ping CLI/credentials none - Do not persist tokens

telemetry.enabled

PINGCLI_TELEMETRY_ENABLED

Boolean

Enable or disable telemetry collection and export.

telemetry.metric.exportInterval

OTEL_METRIC_EXPORT_INTERVAL

Duration

The interval at which metrics are exported to the OTel collector.

telemetry.otlp.endpoint

OTEL_EXPORTER_OTLP_ENDPOINT

String

The OpenTelemetry Protocol (OTLP) gRPC or HTTP collector endpoint URL.

telemetry.otlp.protocol

OTEL_EXPORTER_OTLP_PROTOCOL

String

The OTLP transport protocol to use (e.g., http or grpc).

telemetry.tls.caFile

OTEL_EXPORTER_OTLP_CA_CERTIFICATE

String

The path to the certificate authority (CA) certificate file for verifying the collector server.

telemetry.tls.certFile

OTEL_EXPORTER_OTLP_CERTIFICATE

String

The path to the client certificate file for TLS client authentication.

telemetry.tls.enabled

OTEL_EXPORTER_OTLP_TLS_ENABLED

Boolean

Enable or disable secure TLS communication with the OTel collector.

telemetry.tls.insecureSkipVerify

OTEL_EXPORTER_OTLP_INSECURE

Boolean

Skip OTel collector TLS certificate validation. This is insecure and should not be used in production.

telemetry.tls.keyFile

OTEL_EXPORTER_OTLP_CLIENT_KEY

String

The path to the client private key file for TLS client authentication.

experimental.enabled

PINGCLI_EXPERIMENTAL

Boolean

Enable or disable experimental features in Ping CLI.

log.file

--log-file

PINGCLI_LOG_FILE

String

Write logs to a file at the given path. File logging is disabled when not set.

log.fileLevel

--log-file-level

PINGCLI_LOG_FILE_LEVEL

String (Enum)

Set the file log level. Options are: DEBUG, INFO, WARN, ERROR. (default DEBUG)

log.level

--log-level

PINGCLI_LOG_LEVEL

String (Enum)

Set the console log level. Options are: DEBUG, INFO, WARN, ERROR. (default WARN)