init
Print the minimal env block for your client. Optionally register the app in one step.
base-idp init is the smaller sibling of create. Where create writes a
whole starter project, init just prints the env block. Use it when you
already have a project and just need the right .env lines to paste in.
npx base-idp init --client-id sq_live_yourappBASE_IDP_CLIENT_ID=sq_live_yourappIf you also pass a secret it is included.
npx base-idp init \
--client-id sq_live_yourapp \
--client-secret sqk_3b7157c3d69f11a4af17d6c955ae31fd1fe3183e10b329c1ef4220c3badc0c18BASE_IDP_CLIENT_ID=sq_live_yourapp
BASE_IDP_SECRET=sqk_3b7157c3d69f11a4af17d6c955ae31fd1fe3183e10b329c1ef4220c3badc0c18Registering the app from the CLI
init can also POST a registration request to the admin API, so you can
create an app and copy its env in one shot. This is useful for ephemeral
environments and for scripts that provision dev tenants.
npx base-idp init \
--client-id console-gateway \
--display-name "Console Gateway" \
--product console \
--app-domain console.cloud.squareexp.com \
--allowed-redirect-uris http://localhost:3010/api/auth/callback \
--allowed-origins http://localhost:3010 \
--allowed-scopes "openid profile console:manage" \
--allowed-auth-methods password,magic_link \
--requested-claims email,profile \
--post \
--admin-token "$ADMIN_TOKEN"On success the CLI prints the registration response, then the env block.
What you need
- A valid admin token in
--admin-token(or$BASE_IDP_ADMIN_TOKEN). Talk to the Base IdP operators to get one — these are not handed out lightly. - A unique
--client-idthat fits your product's naming convention. - The full set of redirect URIs you plan to use.
Every option
Required for env output
| Flag | Description |
|---|---|
--client-id <id> | Your OAuth client id. |
Optional for env output
| Flag | Description |
|---|---|
--client-secret <secret> | Confidential clients only. Adds the secret line. |
--secret <secret> | Deprecated alias for --client-secret. |
--issuer <url> | Override the issuer. Auto-resolves if omitted. |
Required for --post registration
| Flag | Description |
|---|---|
--post | Register the client before printing env. |
--admin-token <token> | Admin token. Required with --post. |
Registration body fields
| Flag | Description |
|---|---|
--display-name <name> | What users see on the consent screen. |
--product <product> | Product key. |
--app-domain <domain> | Primary app domain. |
--allowed-redirect-uris <list> | Comma- or space-separated. |
--allowed-origins <list> | CORS origins. |
--allowed-scopes <list> | Scopes the app may request. |
--allowed-auth-methods <list> | password, magic_link, oauth, passkey. |
--requested-claims <list> | Default claims to include in tokens. |
--confidential | Confidential client (default true). Pass --confidential=false for public. |
Why a separate init
Sometimes you do not want generated source files. Maybe you are integrating
into an existing app where the code already exists and you only need to know
"what do I put in .env?" That is the case for init.
The CLI keeps init and create as separate commands so neither one
overflows with flags. create knows about stacks and writes code. init
knows about env and (optionally) registration.