--- title: Configuration settings reference description: The following configuration settings can be applied when using Ping CLI. component: pingcli version: 1.1 page_id: pingcli:settings_reference:configuration-settings-reference canonical_url: https://developer.pingidentity.com/pingcli/1.1/settings_reference/configuration-settings-reference.html llms_txt: https://developer.pingidentity.com/pingcli/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: June 22, 2026 section_ids: general-properties: General Properties ping-identity-platform-service-properties: Ping Identity Platform Service Properties auth-properties: Auth Properties telemetry-properties: Telemetry Properties experimental-properties: Experimental Properties log-properties: Log Properties --- # Configuration settings reference The following configuration settings can be applied when using Ping CLI. The following configuration settings can be applied by using the [`config set` command](../command_reference/pingcli_config_set.html) to persist the configuration value for a given **Configuration Key** in the Ping CLI configuration file. The configuration file is created at `.pingcli/config.yaml` in the user's home directory. ## General Properties | Configuration Key | Equivalent Parameter | Environment Variable | Data Type | Purpose | | ------------------ | ---------------------------- | --------------------------- | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `activeProfile` | | | String | The name of the currently active configuration profile. Ping CLI reads configuration from the profile block matching this name. | | `description` | | | String | A user-defined text description for the configuration profile. | | `detailedExitCode` | `--detailed-exitcode` / `-D` | PINGCLI\_DETAILED\_EXITCODE | Boolean | Enable detailed exit code output. (default false) 0 - Ping CLI command succeeded with no errors or warnings. 1 - Ping CLI command failed with errors. 2 - Ping CLI command succeeded with warnings. | | `noColor` | `--no-color` | PINGCLI\_NO\_COLOR | Boolean | Disable text output in color. (default false) | | `outputFormat` | `--output-format` / `-O` | PINGCLI\_OUTPUT\_FORMAT | String (Enum) | Specify the console output format. (default text) Options are: json, ndjson, ndjson-typed, ndjson-wrapped, text. | ## Ping Identity Platform Service Properties | Configuration Key | Equivalent Parameter | Environment Variable | Data Type | Purpose | | ------------------------------------------------------------------------------------------- | ------------------------------------------------------- | ------------------------------------------------------------------ | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `service.advancedServices.pingfederate.adminAPIPath` | `--as-pingfederate-admin-api-path` | PINGCLI\_AS\_PINGFEDERATE\_ADMIN\_API\_PATH | String | The PingFederate admin API URL path for the Advanced Services private tenant. (default /pf-admin-api/v1) | | `service.advancedServices.pingfederate.authentication.oauth.clientCredentials.clientID` | `--as-pingfederate-client-id` | PINGCLI\_AS\_PINGFEDERATE\_CLIENT\_ID | String | The OAuth 2.0 client ID for PingFederate admin API in Advanced Services when using the client credentials authentication type. | | `service.advancedServices.pingfederate.authentication.oauth.clientCredentials.clientID` | `--as-pingfederate-oauth-client-id` | PINGCLI\_AS\_PINGFEDERATE\_OAUTH\_CLIENT\_ID | String | The OAuth client ID for PingFederate in Advanced Services when using the oauth authentication type with client credentials grant. | | `service.advancedServices.pingfederate.authentication.oauth.clientCredentials.clientSecret` | `--as-pingfederate-client-secret` | PINGCLI\_AS\_PINGFEDERATE\_CLIENT\_SECRET | String | The OAuth 2.0 client secret for PingFederate admin API in Advanced Services when using the client credentials authentication type. | | `service.advancedServices.pingfederate.authentication.oauth.clientCredentials.clientSecret` | `--as-pingfederate-oauth-client-secret` | PINGCLI\_AS\_PINGFEDERATE\_OAUTH\_CLIENT\_SECRET | String | The OAuth client secret for PingFederate in Advanced Services when using the oauth authentication type with client credentials grant. | | `service.advancedServices.pingfederate.authentication.oauth.clientCredentials.scopes` | `--as-pingfederate-oauth-scopes` | PINGCLI\_AS\_PINGFEDERATE\_OAUTH\_SCOPES | String Array | The OAuth scopes for PingFederate in Advanced Services when using the oauth authentication type with client credentials grant. (default \[]) Accepts a comma-separated string to delimit multiple scopes. | | `service.advancedServices.pingfederate.authentication.oauth.clientCredentials.scopes` | `--as-pingfederate-scopes` | PINGCLI\_AS\_PINGFEDERATE\_SCOPES | String Array | The OAuth 2.0 scopes for PingFederate in Advanced Services when using the client credentials authentication type. (default \[]) Accepts a comma-separated string to delimit multiple scopes. | | `service.advancedServices.pingfederate.authentication.oauth.clientCredentials.tokenURL` | `--as-pingfederate-oauth-token-url` | PINGCLI\_AS\_PINGFEDERATE\_OAUTH\_TOKEN\_URL | String | The OAuth token URL for PingFederate in Advanced Services when using the oauth authentication type with client credentials grant. | | `service.advancedServices.pingfederate.authentication.oauth.clientCredentials.tokenURL` | `--as-pingfederate-token-url` | PINGCLI\_AS\_PINGFEDERATE\_TOKEN\_URL | String | The OAuth 2.0 token endpoint URL for PingFederate in Advanced Services when using the client credentials authentication type. | | `service.advancedServices.pingfederate.authentication.oauth.grantType` | `--as-pingfederate-authentication-oauth-grant-type` | PINGCLI\_AS\_PINGFEDERATE\_AUTHENTICATION\_OAUTH\_GRANT\_TYPE | String (Enum) | The OAuth grant type for PingFederate in Advanced Services. Options are: client\_credentials. | | `service.advancedServices.pingfederate.authentication.type` | `--as-pingfederate-authentication-type` | PINGCLI\_AS\_PINGFEDERATE\_AUTHENTICATION\_TYPE | String (Enum) | The authentication type to use when connecting to PingFederate in PingOne Advanced Services. Options are: accessTokenAuth, basicAuth, oauth. Example: 'oauth' | | `service.advancedServices.pingfederate.caCertificatePemFiles` | `--as-pingfederate-ca-certificate-pem-files` | PINGCLI\_AS\_PINGFEDERATE\_CA\_CERTIFICATE\_PEM\_FILES | String Array | Relative or full paths to PEM-encoded certificate files for the Advanced Services PingFederate server. (default \[]) Accepts a comma-separated string to delimit multiple PEM files. | | `service.advancedServices.pingfederate.enabled` | | PINGCLI\_AS\_PINGFEDERATE\_ENABLED | Boolean | Explicitly enable or disable the Advanced Services PingFederate service. | | `service.advancedServices.pingfederate.httpsHost` | `--as-pingfederate-https-host` | PINGCLI\_AS\_PINGFEDERATE\_HTTPS\_HOST | String | The PingFederate HTTPS host for the Advanced Services private tenant. Example: 'https\://pingfederate-admin.bxretail.org' | | `service.advancedServices.pingfederate.insecureTrustAllTLS` | `--as-pingfederate-insecure-trust-all-tls` | PINGCLI\_AS\_PINGFEDERATE\_INSECURE\_TRUST\_ALL\_TLS | Boolean | Trust any certificate when connecting to the PingFederate Advanced Services admin API. (default false) This is insecure and shouldn't be enabled outside of testing. | | `service.advancedServices.pingfederate.softwareVersion` | `--as-pingfederate-software-version` | PINGCLI\_AS\_PINGFEDERATE\_SOFTWARE\_VERSION | String | The PingFederate software version for the Advanced Services private tenant. (default 13.0) | | `service.advancedServices.pingfederate.xBypassExternalValidationHeader` | `--as-pingfederate-x-bypass-external-validation-header` | PINGCLI\_AS\_PINGFEDERATE\_X\_BYPASS\_EXTERNAL\_VALIDATION\_HEADER | Boolean | Bypass connection tests when configuring PingFederate in Advanced Services (the X-BypassExternalValidation header). (default false) | | `service.pingfederate.adminAPIPath` | `--pingfederate-admin-api-path` | PINGCLI\_PINGFEDERATE\_ADMIN\_API\_PATH | String | The PingFederate API URL path used to communicate with PingFederate's admin API. (default /pf-admin-api/v1) | | `service.pingfederate.authentication.accessTokenAuth.accessToken` | `--pingfederate-access-token` | PINGCLI\_PINGFEDERATE\_ACCESS\_TOKEN | String | The PingFederate access token used to authenticate to the PingFederate admin API when using a custom OAuth 2.0 token method. | | `service.pingfederate.authentication.basicAuth.password` | `--pingfederate-password` | PINGCLI\_PINGFEDERATE\_PASSWORD | String | The PingFederate password used to authenticate to the PingFederate admin API when using basic authentication. | | `service.pingfederate.authentication.basicAuth.username` | `--pingfederate-username` | PINGCLI\_PINGFEDERATE\_USERNAME | String | The PingFederate username used to authenticate to the PingFederate admin API when using basic authentication. Example: 'administrator' | | `service.pingfederate.authentication.oauth.clientCredentials.clientID` | `--pingfederate-client-id` | PINGCLI\_PINGFEDERATE\_CLIENT\_ID | String | The PingFederate client ID used to authenticate to the PingFederate admin API when using the client credentials authentication type. | | `service.pingfederate.authentication.oauth.clientCredentials.clientID` | `--pingfederate-oauth-client-id` | PINGCLI\_PINGFEDERATE\_OAUTH\_CLIENT\_ID | String | The PingFederate OAuth client ID used when the authentication type is 'oauth' with a client credentials grant type. | | `service.pingfederate.authentication.oauth.clientCredentials.clientSecret` | `--pingfederate-client-secret` | PINGCLI\_PINGFEDERATE\_CLIENT\_SECRET | String | The PingFederate client secret used to authenticate to the PingFederate admin API when using the client credentials authentication type. | | `service.pingfederate.authentication.oauth.clientCredentials.clientSecret` | `--pingfederate-oauth-client-secret` | PINGCLI\_PINGFEDERATE\_OAUTH\_CLIENT\_SECRET | String | The PingFederate OAuth client secret used when the authentication type is 'oauth' with a client credentials grant type. | | `service.pingfederate.authentication.oauth.clientCredentials.scopes` | `--pingfederate-oauth-scopes` | PINGCLI\_PINGFEDERATE\_OAUTH\_SCOPES | String Array | The PingFederate OAuth scopes used when the authentication type is 'oauth' with a client credentials grant type. (default \[]) Accepts a comma-separated string to delimit multiple scopes. | | `service.pingfederate.authentication.oauth.clientCredentials.scopes` | `--pingfederate-scopes` | PINGCLI\_PINGFEDERATE\_SCOPES | String Array | The PingFederate scopes used to authenticate to the PingFederate admin API when using the client credentials authentication type. (default \[]) Accepts a comma-separated string to delimit multiple scopes. Example: 'openid,profile' | | `service.pingfederate.authentication.oauth.clientCredentials.tokenURL` | `--pingfederate-oauth-token-url` | PINGCLI\_PINGFEDERATE\_OAUTH\_TOKEN\_URL | String | The PingFederate OAuth token URL used when the authentication type is 'oauth' with a client credentials grant type. | | `service.pingfederate.authentication.oauth.clientCredentials.tokenURL` | `--pingfederate-token-url` | PINGCLI\_PINGFEDERATE\_TOKEN\_URL | String | The PingFederate token URL used to authenticate to the PingFederate admin API when using the client credentials authentication type. | | `service.pingfederate.authentication.oauth.grantType` | `--pingfederate-authentication-oauth-grant-type` | PINGCLI\_PINGFEDERATE\_AUTHENTICATION\_OAUTH\_GRANT\_TYPE | String (Enum) | The authentication type to use when connecting to the PingFederate admin API. Options are: client\_credentials. Example: 'client\_credentials' | | `service.pingfederate.authentication.type` | `--pingfederate-authentication-type` | PINGCLI\_PINGFEDERATE\_AUTHENTICATION\_TYPE | String (Enum) | The authentication type to use when connecting to the PingFederate admin API. Options are: accessTokenAuth, basicAuth, oauth. Example: 'oauth' | | `service.pingfederate.caCertificatePemFiles` | `--pingfederate-ca-certificate-pem-files` | PINGCLI\_PINGFEDERATE\_CA\_CERTIFICATE\_PEM\_FILES | String Array | Relative or full paths to PEM-encoded certificate files to be trusted as root CAs when connecting to the PingFederate server over HTTPS. (default \[]) Accepts a comma-separated string to delimit multiple PEM files. | | `service.pingfederate.enabled` | | PINGCLI\_PINGFEDERATE\_ENABLED | Boolean | Explicitly enable or disable the PingFederate service. | | `service.pingfederate.httpsHost` | `--pingfederate-https-host` | PINGCLI\_PINGFEDERATE\_HTTPS\_HOST | String | The PingFederate HTTPS host used to communicate with PingFederate's admin API. Example: 'https\://pingfederate-admin.bxretail.org' | | `service.pingfederate.insecureTrustAllTLS` | `--pingfederate-insecure-trust-all-tls` | PINGCLI\_PINGFEDERATE\_INSECURE\_TRUST\_ALL\_TLS | Boolean | Trust any certificate when connecting to the PingFederate server admin API. (default false) This is insecure and shouldn't be enabled outside of testing. | | `service.pingfederate.softwareVersion` | `--pingfederate-software-version` | PINGCLI\_PINGFEDERATE\_SOFTWARE\_VERSION | String | The PingFederate software version to use when connecting to the PingFederate admin API. This is used to select the correct SDK version for authentication. After successful authentication, the actual running version is auto-detected from the API. (default 13.0) Example: '13.0' | | `service.pingfederate.xBypassExternalValidationHeader` | `--pingfederate-x-bypass-external-validation-header` | PINGCLI\_PINGFEDERATE\_X\_BYPASS\_EXTERNAL\_VALIDATION\_HEADER | Boolean | Bypass connection tests when configuring PingFederate (the X-BypassExternalValidation header when using PingFederate's admin API). (default false) | | `service.pingone.authentication.authorizationCode.clientID` | | PINGCLI\_PINGONE\_AUTHORIZATION\_CODE\_CLIENT\_ID | String (UUID Format) | The authorization code client ID used to authenticate to the PingOne management API. | | `service.pingone.authentication.authorizationCode.redirectUri.path` | | | String | The custom redirect URI path for the local redirect web server during authorization code authentication. | | `service.pingone.authentication.authorizationCode.redirectUri.port` | | | String | The custom port for the local redirect web server during authorization code authentication. | | `service.pingone.authentication.authorizationCode.scopes` | | PINGCLI\_PINGONE\_AUTHORIZATION\_CODE\_SCOPES | String Array | The authorization code scopes used to authenticate to the PingOne management API. | | `service.pingone.authentication.clientCredentials.clientID` | | PINGCLI\_PINGONE\_CLIENT\_CREDENTIALS\_CLIENT\_ID | String (UUID Format) | The client credentials client ID used to authenticate to the PingOne management API. | | `service.pingone.authentication.clientCredentials.clientSecret` | | PINGCLI\_PINGONE\_CLIENT\_CREDENTIALS\_CLIENT\_SECRET | String | The client credentials client secret used to authenticate to the PingOne management API. | | `service.pingone.authentication.clientCredentials.scopes` | | PINGCLI\_PINGONE\_CLIENT\_CREDENTIALS\_SCOPES | String Array | The client credentials scopes used to authenticate to the PingOne management API. | | `service.pingone.authentication.deviceCode.clientID` | | PINGCLI\_PINGONE\_DEVICE\_CODE\_CLIENT\_ID | String (UUID Format) | The device code client ID used to authenticate to the PingOne management API. | | `service.pingone.authentication.deviceCode.scopes` | | PINGCLI\_PINGONE\_DEVICE\_CODE\_SCOPES | String Array | The device code scopes used to authenticate to the PingOne management API. | | `service.pingone.authentication.grantType` | | PINGCLI\_PINGONE\_AUTHENTICATION\_TYPE | String (Enum) | The authorization grant type to use to authenticate to the PingOne management API. Options are: authorization\_code, client\_credentials, device\_code. | | `service.pingone.enabled` | | PINGCLI\_PINGONE\_ENABLED | Boolean | Explicitly enable or disable the PingOne service. | | `service.pingone.endpoint.customDomain` | | PINGCLI\_PINGONE\_CUSTOM\_DOMAIN | String | The custom domain of the PingOne tenant. Example: 'auth.bxretail.org'. | | `service.pingone.endpoint.environmentID` | | PINGCLI\_PINGONE\_ENVIRONMENT\_ID | String (UUID Format) | The ID of the PingOne environment to use for authentication (used by all auth types). | | `service.pingone.endpoint.rootDomain` | | PINGCLI\_PINGONE\_ROOT\_DOMAIN | String (Enum) | The root domain of the PingOne tenant. Options are: pingone.asia, pingone.ca, pingone.com, pingone.com.au, pingone.eu, pingone.sg. Example: 'pingone.com'. | ## Auth Properties | Configuration Key | Equivalent Parameter | Environment Variable | Data Type | Purpose | | ------------------- | -------------------- | ---------------------------- | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `auth.storage.type` | `--storage-type` | PINGCLI\_AUTH\_STORAGE\_TYPE | String (Enum) | Auth token storage (default: secure\_local) secure\_local - Use OS keychain (default) file\_system - Store tokens in \~/.Ping CLI/credentials none - Do not persist tokens | ## Telemetry Properties | Configuration Key | Equivalent Parameter | Environment Variable | Data Type | Purpose | | ---------------------------------- | -------------------- | ------------------------------------- | --------- | ------------------------------------------------------------------------------------------------------ | | `telemetry.enabled` | | PINGCLI\_TELEMETRY\_ENABLED | Boolean | Enable or disable telemetry collection and export. | | `telemetry.metric.exportInterval` | | OTEL\_METRIC\_EXPORT\_INTERVAL | Duration | The interval at which metrics are exported to the OTel collector. | | `telemetry.otlp.endpoint` | | OTEL\_EXPORTER\_OTLP\_ENDPOINT | String | The OpenTelemetry Protocol (OTLP) gRPC or HTTP collector endpoint URL. | | `telemetry.otlp.protocol` | | OTEL\_EXPORTER\_OTLP\_PROTOCOL | String | The OTLP transport protocol to use (e.g., http or grpc). | | `telemetry.tls.caFile` | | OTEL\_EXPORTER\_OTLP\_CA\_CERTIFICATE | String | The path to the certificate authority (CA) certificate file for verifying the collector server. | | `telemetry.tls.certFile` | | OTEL\_EXPORTER\_OTLP\_CERTIFICATE | String | The path to the client certificate file for TLS client authentication. | | `telemetry.tls.enabled` | | OTEL\_EXPORTER\_OTLP\_TLS\_ENABLED | Boolean | Enable or disable secure TLS communication with the OTel collector. | | `telemetry.tls.insecureSkipVerify` | | OTEL\_EXPORTER\_OTLP\_INSECURE | Boolean | Skip OTel collector TLS certificate validation. This is insecure and should not be used in production. | | `telemetry.tls.keyFile` | | OTEL\_EXPORTER\_OTLP\_CLIENT\_KEY | String | The path to the client private key file for TLS client authentication. | ## Experimental Properties | Configuration Key | Equivalent Parameter | Environment Variable | Data Type | Purpose | | ---------------------- | -------------------- | --------------------- | --------- | ---------------------------------------------------- | | `experimental.enabled` | | PINGCLI\_EXPERIMENTAL | Boolean | Enable or disable experimental features in Ping CLI. | ## Log Properties | Configuration Key | Equivalent Parameter | Environment Variable | Data Type | Purpose | | ----------------- | -------------------- | ------------------------- | ------------- | -------------------------------------------------------------------------------- | | `log.file` | `--log-file` | PINGCLI\_LOG\_FILE | String | Write logs to a file at the given path. File logging is disabled when not set. | | `log.fileLevel` | `--log-file-level` | PINGCLI\_LOG\_FILE\_LEVEL | String (Enum) | Set the file log level. Options are: DEBUG, INFO, WARN, ERROR. (default DEBUG) | | `log.level` | `--log-level` | PINGCLI\_LOG\_LEVEL | String (Enum) | Set the console log level. Options are: DEBUG, INFO, WARN, ERROR. (default WARN) |