--- title: Configuration Settings Reference description: The following configuration settings can be applied when using Ping CLI. component: pingcli page_id: pingcli::general/cli-configuration-settings-reference canonical_url: https://developer.pingidentity.com/pingcli/general/cli-configuration-settings-reference.html revdate: January 13, 2026 section_ids: general-properties: General Properties ping-identity-platform-service-properties: Ping Identity Platform Service Properties platform-export-properties: Platform Export Properties license-properties: License Properties custom-request-properties: Custom Request Properties auth-properties: Auth properties --- # Configuration Settings Reference The following configuration settings can be applied when using Ping CLI. The following configuration settings can be applied by using the [`config set` command](../command_reference/pingcli_config_set.html) to persist the configuration value for a given **Configuration Key** in the Ping CLI configuration file. The configuration file is created at `.pingcli/config.yaml` in the user's home directory. ## General Properties | Configuration Key | Equivalent Parameter | Environment Variable | Data Type | Purpose | | ------------------ | ---------------------------- | --------------------------- | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `activeProfile` | | | String | | | `description` | | | String | | | `detailedExitCode` | `--detailed-exitcode` / `-D` | PINGCLI\_DETAILED\_EXITCODE | Boolean | Enable detailed exit code output. (default false) 0 - pingcli command succeeded with no errors or warnings. 1 - pingcli command failed with errors. 2 - pingcli command succeeded with warnings. | | `noColor` | `--no-color` | PINGCLI\_NO\_COLOR | Boolean | Disable text output in color. (default false) | | `outputFormat` | `--output-format` / `-O` | PINGCLI\_OUTPUT\_FORMAT | String (Enum) | Specify the console output format. (default text) Options are: json, text. | | `plugins` | | | String Array | | ## Ping Identity Platform Service Properties | Configuration Key | Equivalent Parameter | Environment Variable | Data Type | Purpose | | ------------------------------------------------------------------------ | ---------------------------------------------------- | -------------------------------------------------------------- | -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `service.pingfederate.adminAPIPath` | `--pingfederate-admin-api-path` | PINGCLI\_PINGFEDERATE\_ADMIN\_API\_PATH | String | The PingFederate API URL path used to communicate with PingFederate's admin API. (default /pf-admin-api/v1) | | `service.pingfederate.authentication.accessTokenAuth.accessToken` | `--pingfederate-access-token` | PINGCLI\_PINGFEDERATE\_ACCESS\_TOKEN | String | The PingFederate access token used to authenticate to the PingFederate admin API when using a custom OAuth 2.0 token method. | | `service.pingfederate.authentication.basicAuth.password` | `--pingfederate-password` | PINGCLI\_PINGFEDERATE\_PASSWORD | String | The PingFederate password used to authenticate to the PingFederate admin API when using basic authentication. | | `service.pingfederate.authentication.basicAuth.username` | `--pingfederate-username` | PINGCLI\_PINGFEDERATE\_USERNAME | String | The PingFederate username used to authenticate to the PingFederate admin API when using basic authentication. Example: 'administrator' | | `service.pingfederate.authentication.clientCredentialsAuth.clientID` | `--pingfederate-client-id` | PINGCLI\_PINGFEDERATE\_CLIENT\_ID | String | The PingFederate OAuth client ID used to authenticate to the PingFederate admin API when using the OAuth 2.0 client credentials grant type. | | `service.pingfederate.authentication.clientCredentialsAuth.clientSecret` | `--pingfederate-client-secret` | PINGCLI\_PINGFEDERATE\_CLIENT\_SECRET | String | The PingFederate OAuth client secret used to authenticate to the PingFederate admin API when using the OAuth 2.0 client credentials grant type. | | `service.pingfederate.authentication.clientCredentialsAuth.scopes` | `--pingfederate-scopes` | PINGCLI\_PINGFEDERATE\_SCOPES | String Array | The PingFederate OAuth scopes used to authenticate to the PingFederate admin API when using the OAuth 2.0 client credentials grant type. (default \[]) Accepts a comma-separated string to delimit multiple scopes. Example: 'openid,profile' | | `service.pingfederate.authentication.clientCredentialsAuth.tokenURL` | `--pingfederate-token-url` | PINGCLI\_PINGFEDERATE\_TOKEN\_URL | String | The PingFederate OAuth token URL used to authenticate to the PingFederate admin API when using the OAuth 2.0 client credentials grant type. | | `service.pingfederate.authentication.type` | `--pingfederate-authentication-type` | PINGCLI\_PINGFEDERATE\_AUTHENTICATION\_TYPE | String (Enum) | The authentication type to use when connecting to the PingFederate admin API. Options are: accessTokenAuth, basicAuth, clientCredentialsAuth. Example: 'basicAuth' | | `service.pingfederate.caCertificatePemFiles` | `--pingfederate-ca-certificate-pem-files` | PINGCLI\_PINGFEDERATE\_CA\_CERTIFICATE\_PEM\_FILES | String Array | Relative or full paths to PEM-encoded certificate files to be trusted as root CAs when connecting to the PingFederate server over HTTPS. (default \[]) Accepts a comma-separated string to delimit multiple PEM files. | | `service.pingfederate.httpsHost` | `--pingfederate-https-host` | PINGCLI\_PINGFEDERATE\_HTTPS\_HOST | String | The PingFederate HTTPS host used to communicate with PingFederate's admin API. Example: 'https\://pingfederate-admin.bxretail.org' | | `service.pingfederate.insecureTrustAllTLS` | `--pingfederate-insecure-trust-all-tls` | PINGCLI\_PINGFEDERATE\_INSECURE\_TRUST\_ALL\_TLS | Boolean | Trust any certificate when connecting to the PingFederate server admin API. (default false) This is insecure and shouldn't be enabled outside of testing. | | `service.pingfederate.xBypassExternalValidationHeader` | `--pingfederate-x-bypass-external-validation-header` | PINGCLI\_PINGFEDERATE\_X\_BYPASS\_EXTERNAL\_VALIDATION\_HEADER | Boolean | Bypass connection tests when configuring PingFederate (the X-BypassExternalValidation header when using PingFederate's admin API). (default false) | | `service.pingone.authentication.authorizationCode.clientID` | `--pingone-authorization-code-client-id` | PINGCLI\_PINGONE\_AUTHORIZATION\_CODE\_CLIENT\_ID | String (UUID Format) | The authorization code client ID used to authenticate to the PingOne management API. | | `service.pingone.authentication.authorizationCode.redirectURIPath` | `--pingone-authorization-code-redirect-uri-path` | PINGCLI\_PINGONE\_AUTHORIZATION\_CODE\_REDIRECT\_URI\_PATH | String | The redirect URI path to use when using the authorization code authorization grant type to authenticate to the PingOne management API. (default /callback) | | `service.pingone.authentication.authorizationCode.redirectURIPort` | `--pingone-authorization-code-redirect-uri-port` | PINGCLI\_PINGONE\_AUTHORIZATION\_CODE\_REDIRECT\_URI\_PORT | String | The redirect URI port to use when using the authorization code authorization grant type to authenticate to the PingOne management API. (default 7464) | | `service.pingone.authentication.clientCredentials.clientID` | `--pingone-client-credentials-client-id` | PINGCLI\_PINGONE\_CLIENT\_CREDENTIALS\_CLIENT\_ID | String (UUID Format) | The client credentials client ID used to authenticate to the PingOne management API. | | `service.pingone.authentication.clientCredentials.clientSecret` | `--pingone-client-credentials-client-secret` | PINGCLI\_PINGONE\_CLIENT\_CREDENTIALS\_CLIENT\_SECRET | String | The client credentials client secret used to authenticate to the PingOne management API. | | `service.pingone.authentication.deviceCode.clientID` | `--pingone-device-code-client-id` | PINGCLI\_PINGONE\_DEVICE\_CODE\_CLIENT\_ID | String (UUID Format) | The device code client ID used to authenticate to the PingOne management API. | | `service.pingone.authentication.environmentID` | `--pingone-environment-id` | PINGCLI\_PINGONE\_ENVIRONMENT\_ID | String (UUID Format) | The ID of the PingOne environment to use for authentication (used by all auth types). | | `service.pingone.authentication.type` | `--pingone-authentication-type` | PINGCLI\_PINGONE\_AUTHENTICATION\_TYPE | String (Enum) | The authorization grant type to use to authenticate to the PingOne management API. (default worker) Options are: authorization\_code, client\_credentials, device\_code, worker. | | `service.pingone.authentication.worker.clientID` | `--pingone-worker-client-id` | PINGCLI\_PINGONE\_WORKER\_CLIENT\_ID | String (UUID Format) | DEPRECATED: Use --pingone-client-credentials-client-id instead. The worker client ID used to authenticate to the PingOne management API. | | `service.pingone.authentication.worker.clientSecret` | `--pingone-worker-client-secret` | PINGCLI\_PINGONE\_WORKER\_CLIENT\_SECRET | String | DEPRECATED: Use --pingone-client-credentials-client-secret instead. The worker client secret used to authenticate to the PingOne management API. | | `service.pingone.authentication.worker.environmentID` | `--pingone-worker-environment-id` | PINGCLI\_PINGONE\_WORKER\_ENVIRONMENT\_ID | String (UUID Format) | DEPRECATED: Use --pingone-environment-id instead. The ID of the PingOne environment that contains the worker client used to authenticate to the PingOne management API. | | `service.pingone.regionCode` | `--pingone-region-code` | PINGCLI\_PINGONE\_REGION\_CODE | String (Enum) | The region code of the PingOne tenant. Options are: AP, AU, CA, EU, NA, SG. Example: 'NA' | ## Platform Export Properties | Configuration Key | Equivalent Parameter | Environment Variable | Data Type | Purpose | | ------------------------------ | --------------------------------- | ----------------------------------------- | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `export.format` | `--format` / `-f` | PINGCLI\_EXPORT\_FORMAT | String (Enum) | Specifies the export format. (default HCL) Options are: HCL. | | `export.outputDirectory` | `--output-directory` / `-d` | PINGCLI\_EXPORT\_OUTPUT\_DIRECTORY | String | Specifies the output directory for export. Can be an absolute filepath or a relative filepath of the present working directory. Example: '/Users/example/pingcli-export' Example: 'pingcli-export' | | `export.overwrite` | `--overwrite` / `-o` | PINGCLI\_EXPORT\_OVERWRITE | Boolean | Overwrites the existing generated exports in output directory. (default false) | | `export.pingone.environmentID` | `--pingone-export-environment-id` | PINGCLI\_PINGONE\_EXPORT\_ENVIRONMENT\_ID | String (UUID Format) | The ID of the PingOne environment to export. Must be a valid PingOne UUID. | | `export.serviceGroup` | `--service-group` / `-g` | PINGCLI\_EXPORT\_SERVICE\_GROUP | String (Enum) | Specifies the service group to export. Options are: pingone. Example: 'pingone' | | `export.services` | `--services` / `-s` | PINGCLI\_EXPORT\_SERVICES | String Array | Specifies the service(s) to export. Accepts a comma-separated string to delimit multiple services. Options are: pingfederate, pingone-authorize, pingone-mfa, pingone-platform, pingone-protect, pingone-sso. Example: 'pingone-sso,pingone-mfa,pingfederate' | ## License Properties | Configuration Key | Equivalent Parameter | Environment Variable | Data Type | Purpose | | -------------------- | ---------------------- | ------------------------------ | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `license.devopsKey` | `--devops-key` / `-k` | PINGCLI\_LICENSE\_DEVOPS\_KEY | String | The DevOps key for the license request. See on how to register a DevOps user. You can save the DevOps user and key in your profile using the 'pingcli config' commands. | | `license.devopsUser` | `--devops-user` / `-u` | PINGCLI\_LICENSE\_DEVOPS\_USER | String | The DevOps user for the license request. See on how to register a DevOps user. You can save the DevOps user and key in your profile using the 'pingcli config' commands. | ## Custom Request Properties | Configuration Key | Equivalent Parameter | Environment Variable | Data Type | Purpose | | --------------------------- | -------------------- | ------------------------- | ------------- | --------------------------------------------------------------------------------------------------------------------------- | | `request.accessToken` | | | String | | | `request.accessTokenExpiry` | | | Integer | | | `request.fail` | `--fail` / `-f` | | Boolean | Return non-zero exit code when HTTP custom request returns a failure status code. | | `request.service` | `--service` / `-s` | PINGCLI\_REQUEST\_SERVICE | String (Enum) | The Ping service (configured in the active profile) to send the custom request to. Options are: pingone. Example: 'pingone' | ## Auth properties | Configuration Key | Equivalent Parameter | Environment Variable | Data Type | Purpose | | -------------------- | -------------------- | ----------------------------- | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `login.storage.type` | `--storage-type` | PINGCLI\_LOGIN\_STORAGE\_TYPE | String (Enum) | Auth token storage (default: secure\_local) secure\_local - Use OS keychain (default) file\_system - Store tokens in \~/.pingcli/credentials none - Do not persist tokens |