silicon-accounts CLI reference

silicon-accounts --help                 # everything: the command tree, bundled guides, environment, exit codes
silicon-accounts silicon create --help  # one command: what it does, its options, examples
silicon-accounts --json                 # the command tree as JSON: {"commands":[{"command","about"},…]}

accounts [OPTIONS] [COMMAND]

{
  "error": {
    "code": "invalid_grant",
    "exit_code": 3,
    "hint": "Start a new sign-in. Codes and short-lived tokens are single-use and live 2 minutes; presenting an already-used refresh token revokes the whole token family, so sign in again.",
    "message": "The short-lived token was already used; each one works once. Get a new one.",
    "request_id": "01a11434-14f4-7710-a5df-4cdc49b7b130",
    "status": 400
  }
}

{
  "error": {
    "code": "wrong_account_kind",
    "exit_code": 3,
    "hint": "Sign in as a Carbon with `silicon-accounts login` (Silicons don't have this).",
    "message": "Custodian requests is for Carbon accounts, but you are signed in as Silicon si:scout."
  }
}

  accounts                                  Show this package's Silicon Accounts identity for
                                            Silicon Apps discovery
  login                                     Sign in as a Carbon or a Silicon, or get a short-lived
                                            token for an app
    login status                            Report whether you are signed in and as whom (JSON
                                            exits 0; text exits 1 when signed out)
  logout                                    Sign out: revoke this CLI session and delete the
                                            stored tokens
  whoami                                    Show the signed-in account (uuid, id, kind,
                                            custodian…)
  id                                        Check whether an id is available, or change your own
                                            c:id / si:id
    id available <ID>                       Check whether a c:id or si:id can be taken (exit 0
                                            available, 5 taken/reserved, 2 invalid)
    id change <NEW_ID>                      Change your own c:id / si:id (the prefix is added if
                                            you omit it)
  lookup <TARGET>                           Look up an account by uuid or by c:id / si:id
  profile                                   Show or edit your profile: display name, timezone,
                                            date of birth, photo
    profile show                            Show your full profile (same as `silicon-accounts
                                            whoami`)
    profile set                             Change profile fields; only the flags you pass change
  email                                     Manage your email addresses (Carbons): list, add +
                                            verify, make primary, remove
    email list                              List your email addresses
    email add <EMAIL>                       Add an email: sends a 6-digit code (asks for it when
                                            run in a terminal)
    email verify <CHALLENGE_ID> <CODE>      Confirm an added email with its code
    email primary <EMAIL>                   Make an email your primary one (apps with the email
                                            scope are told)
    email remove <EMAIL>                    Remove an email (not the primary one)
  phone                                     Manage your phone numbers (Carbons): list, add +
                                            verify, make primary, remove
    phone list                              List your phone numbers
    phone add <PHONE>                       Add a phone number: sends a 6-digit code by SMS
    phone verify <CHALLENGE_ID> <CODE>      Confirm an added number with its code
    phone primary <PHONE>                   Make a number your primary one
    phone remove <PHONE>                    Remove a number (not the primary one)
  identities                                List or unlink the Google / Apple identities linked to
                                            your account
    identities list                         List linked Google / Apple identities
    identities remove <PROVIDER> <SUBJECT>  Unlink an identity
  apps                                      Apps you signed into: list them, or remove an app's
                                            access
    apps list                               List the apps you signed into, with what you share
                                            with each
    apps remove <APP_ID>                    Remove an app's access to your account
  proofs                                    User verification proofs apps issued on your behalf:
                                            list or revoke them
    proofs list                             List User verification proofs issued on your behalf
    proofs revoke <PROOF_ID>                Revoke a User verification proof
  sessions                                  Your browser sessions and CLI sign-ins: list or revoke
                                            them
    sessions list                           List browser sessions and CLI sign-ins
    sessions revoke <ID>                    Revoke a session (it is signed out everywhere it is
                                            used)
  history                                   Your account history: sign-ins, id changes, custodian
                                            changes, proofs, app access
  silicon                                   Silicons: create one, manage the Silicons you are
                                            custodian of, check a request
    silicon create                          Create a Silicon account
    silicon list                            List the Silicons you are custodian of
    silicon show <SILICON>                  Show one of your Silicons (by si:id or uuid)
    silicon update <SILICON>                Change one of your Silicons' display name, timezone or
                                            photo (a URL, or upload a file)
    silicon id <SILICON> <NEW_ID>           Change one of your Silicons' si:id (apps it signed
                                            into are notified)
    silicon rotate-stk <SILICON>            Rotate a Silicon's STK: the old one stops working and
                                            its sessions are revoked
    silicon webhook                         One of your Silicons' webhook: set or remove the
                                            endpoint, see and replay its deliveries
      silicon webhook set <SILICON> <URL>   Set the endpoint (prints the signing secret once)
      silicon webhook remove <SILICON>      Remove the endpoint
      silicon webhook deliveries <SILICON>  List the deliveries of the Silicon's webhook, newest
                                            first
      silicon webhook delivery <SILICON> <ID>
                                            Show one delivery of the Silicon's webhook with its
                                            attempts and the exact payload
      silicon webhook replay <SILICON> [IDS]
                                            Re-queue deliveries of the Silicon's webhook (same
                                            event id, its current URL and secret)
    silicon apps                            The apps one of your Silicons signed into: list them,
                                            remove one, and choose which apps it may sign into
      silicon apps list <SILICON>           List the apps the Silicon signed into, most recently
                                            used first
      silicon apps remove <SILICON> <APP_ID>
                                            Remove the Silicon's access to one app (its sign-ins
                                            there end)
      silicon apps allow <SILICON> [APPS]   Set the apps the Silicon may get short-lived tokens
                                            for (replaces the list)
      silicon apps allowed <SILICON>        Show the apps the Silicon may get short-lived tokens
                                            for
    silicon keys                            A Silicon's keys: sign in with a key instead of the
                                            STK, so an unattended Silicon never holds a bearer
                                            secret
      silicon keys add <SILICON>            Register a key: generate a new one, or give a private
                                            or public key file
      silicon keys list <SILICON>           List a Silicon's keys (revoked ones too)
      silicon keys revoke <SILICON> <KEY_ID>
                                            Revoke a key: it stops working and the sign-ins it
                                            started end
    silicon trust                           A Silicon's trust relationships: let a CI job (GitHub
                                            Actions, GitLab, any https OIDC issuer) sign it in
                                            with the job's own token, so no secret is stored in CI
      silicon trust add <SILICON>           Trust tokens from an issuer whose claims match:
                                            --github, --gitlab, or --issuer with --claim
      silicon trust list <SILICON>          List a Silicon's trusts (removed ones too)
      silicon trust remove <SILICON> <TRUST_ID>
                                            Remove a trust: it stops working and the sign-ins it
                                            started end
    silicon audiences                       The outside services a Silicon may get identity tokens
                                            for (AWS, Google Cloud, Microsoft Entra)
      silicon audiences list <SILICON>      Show the audiences the Silicon may get identity tokens
                                            for
      silicon audiences allow <SILICON> <AUDIENCES>
                                            Allow more audiences (custodian): sts.amazonaws.com,
                                            your Google Cloud provider's URL,
                                            api://AzureADTokenExchange
      silicon audiences remove <SILICON> [AUDIENCES]
                                            Stop allowing audiences (custodian); with --all, allow
                                            none
    silicon signins <SILICON>               One of your Silicons' sign-ins, newest first (app,
                                            method, outcome, address)
    silicon transfer <SILICON>              Transfer a Silicon to another Carbon (they must accept
                                            within 14 days)
    silicon cancel-transfer <SILICON>       Cancel a pending transfer
    silicon delete <SILICON>                Delete one of your Silicons permanently
    silicon request                         A self-created Silicon's custodian request
      silicon request status <REQUEST_ID>   Check (or wait for) the custodian's decision on a
                                            self-created Silicon
  webhook                                   A Silicon's own webhook: get notified about your
                                            account (custodian decisions, STK rotations, changes),
                                            and see or replay its deliveries
    webhook set <URL>                       Set your webhook endpoint (prints the signing secret
                                            once)
    webhook remove                          Remove your webhook endpoint
    webhook test                            Send a test `ping` delivery
    webhook deliveries                      List your webhook's deliveries, newest first (failed
                                            ones can be replayed)
    webhook delivery <ID>                   Show one delivery with its attempts and the exact
                                            payload that was signed
    webhook replay [IDS]                    Re-queue deliveries (same event id, sent to your
                                            current URL and signed with your current secret)
  custodian                                 Custodian requests addressed to you (Carbons): list,
                                            accept, decline
    custodian requests                      List custodian requests waiting for you
    custodian accept <ID>                   Accept a request: you become the Silicon's custodian
    custodian decline <ID>                  Decline a request
  device                                    Approve or deny a CLI sign-in code shown on another
                                            machine (Carbons)
    device show <CODE>                      Show a pending CLI sign-in (label, status, expiry)
    device approve <CODE>                   Approve it: the other machine gets signed in as you
    device deny <CODE>                      Deny it
  token                                     Tokens for outside services: an identity token proves
                                            a Silicon to AWS, Google Cloud or Microsoft Entra with
                                            no stored cloud key
    token identity                          Print an identity token (an RS256 OIDC ID token) for
                                            an outside service, signed in as a Silicon
  app                                       App mode: an app's sign-in setup, user base, imports,
                                            tokens, webhooks and proofs
    app use <APP_ID>                        Choose the app for later `silicon-accounts app`
                                            commands and store its secret (0600)
    app list                                List the apps you own (signed in as a Carbon)
    app new                                 Make a new app: apps are created in Silicon Apps
                                            (opens it)
    app show                                Show the app, its sign-in setup and user base stats
    app config                              The app's sign-in setup: methods, Google/Apple,
                                            branding, required details, redirect URIs
      app config get                        Print the sign-in setup as JSON (secrets masked)
      app config set <FILE>                 Apply a JSON patch (deep merge, arrays replace) from a
                                            file or stdin (-)
      app config history                    Show the history of sign-in setup changes
    app users                               List the app's user base
    app user <UUID>                         Show one account in the user base, with its last
                                            sign-ins
    app import [FILE]                       Import existing users (CSV or JSON), or inspect import
                                            jobs
      app import status <JOB>               Show an import job (add --wait to follow it)
      app import rows <JOB>                 Show per-row outcomes of an import job
      app import list                       List import jobs
    app token                               Token endpoint calls: exchange codes and SLTs,
                                            refresh, introspect, revoke, verify
      app token exchange                    Exchange an authorization code from your redirect URI
      app token slt <SLT>                   Exchange a Silicon's short-lived token (slt_…)
      app token refresh <REFRESH_TOKEN>     Rotate a refresh token (store the new one)
      app token introspect <TOKEN>          Ask whether a token of this app is active
      app token revoke <TOKEN>              Revoke a token's family (signs the account out of the
                                            app)
      app token verify <ACCESS_TOKEN>       Verify an access token locally with the JWKS (exit 0
                                            valid, 2 invalid)
    app userinfo <ACCESS_TOKEN>             Fetch userinfo with an access token issued to this app
    app proof                               User verification and App verification proofs: issue,
                                            verify, refresh, revoke, list
      app proof user-verification           Issue a User verification proof: act at another app on
                                            behalf of an account that consented in your app
      app proof app-verification            Issue an app verification proof that one other app can
                                            verify (one proof per app)
      app proof verify <TOKEN>              Verify a proof token as this app: exit 0 when valid, 2
                                            when not
      app proof refresh <REFRESH_TOKEN>     Get a new proof token with the proof refresh token (it
                                            rotates)
      app proof revoke [PROOF_ID]           Revoke a proof this app issued (by id, proof token or
                                            refresh token)
      app proof list                        List proofs this app issued
    app webhook                             The app's webhook: endpoint, secret, test, deliveries,
                                            replay
      app webhook set <URL>                 Set the endpoint (a new signing secret is printed
                                            once)
      app webhook remove                    Remove the endpoint
      app webhook rotate                    Rotate the signing secret (printed once; the old one
                                            stops immediately)
      app webhook test                      Queue a test `ping` delivery (a retry with the same
                                            --idempotency-key queues no second ping)
      app webhook deliveries                List deliveries
      app webhook delivery <ID>             Show one delivery with its attempts and payload
      app webhook replay [IDS]              Re-queue deliveries (same event id, current URL and
                                            secret)
    app subscription                        Event subscriptions: where the app's updates go (its
                                            webhook or the event stream), which updates it wants,
                                            and whether each is active or paused
      app subscription list                 List the app's subscriptions
      app subscription show <ID>            Show one subscription
      app subscription create <DELIVERY> [URL]
                                            Create a subscription (a webhook's signing secret is
                                            printed once)
      app subscription update <ID>          Change a subscription: its updates, pause or resume
                                            it, or move a webhook (the secret stays)
      app subscription delete <ID>          Delete a subscription (deleting the webhook
                                            subscription removes the app's webhook)
      app subscription test <ID>            Queue a test `ping` on a subscription
    app lookup <TARGET>                     Look up an account by uuid or id with the app's
                                            credentials
  config                                    CLI settings: home directory, URL, telemetry
    config home [DIR]                       Show or set the home directory that holds .accounts/
                                            (errors if it is not a directory)
    config get [KEY]                        Show settings and where each value comes from
    config set <KEY> <VALUE>                Set a setting in config.json: url <URL> or telemetry
                                            on|off
    config unset <KEY>                      Remove a setting from config.json: url, telemetry or
                                            app
    config telemetry <STATE>                Turn telemetry on or off (it is on by default)
  report <MESSAGE>                          Report a bug to the Silicon Accounts maintainers,
                                            optionally with the PR that fixes it
  docs [TOPIC]                              Read the bundled docs (guides for Silicons, Carbons
                                            and apps)
  help [TOPIC]                              Help for a command (`silicon-accounts help silicon
                                            create`) or a docs topic (`silicon-accounts help
                                            imports`)
  delete-account                            Delete your account permanently (requires --confirm
                                            <your id>)

silicon-accounts login [OPTIONS]
silicon-accounts login <COMMAND>

silicon-accounts login                                   Carbon: browser code (device flow)
silicon-accounts login --no-browser                      print the code and URL only
silicon-accounts login --email saket@example.com         Carbon: code by email (prompts for it)
silicon-accounts login --email saket@example.com --code 123456
                                                 finish a code sent by an earlier call
printf '%s' "$STK" | silicon-accounts login --silicon si:scout --stk-stdin
ACCOUNTS_SILICON=si:scout ACCOUNTS_STK=stk-… silicon-accounts login --json
silicon-accounts login --silicon si:scout --federated --github-actions
                                                 in a GitHub Actions job, no stored secret
silicon-accounts login --silicon si:scout --federated env:SILICON_ID_TOKEN
                                                 GitLab CI (an id_tokens variable)
silicon-accounts login --app remind                      print a short-lived token for remind
silicon-accounts login status --json                     {"authenticated":true,"kind":"silicon",…}

Exit codes: 0 ok, 1 failure, 2 invalid input, 3 not signed in or credentials refused,
6 locked or rate limited.

silicon-accounts login status [OPTIONS]

silicon-accounts login status
silicon-accounts login status --json
silicon-accounts login status --offline --json

silicon-accounts logout [OPTIONS]

silicon-accounts logout
silicon-accounts logout --json

silicon-accounts whoami [OPTIONS]

silicon-accounts whoami
silicon-accounts whoami --json | jq -r .uuid

silicon-accounts id [OPTIONS] <COMMAND>

silicon-accounts id available c:saket
silicon-accounts id available si:head_of_growth --json
silicon-accounts id change c:saket_dev

silicon-accounts id available [OPTIONS] <ID>

silicon-accounts id available c:saket
silicon-accounts id available si:scout --json
silicon-accounts id available si:scout --for si:scout_v2

silicon-accounts id change [OPTIONS] <NEW_ID>

silicon-accounts id change c:saket_dev
silicon-accounts id change scout_v2

silicon-accounts lookup [OPTIONS] <TARGET>

silicon-accounts lookup c:saket
silicon-accounts lookup a8K --json

silicon-accounts profile [OPTIONS] <COMMAND>

silicon-accounts profile show
silicon-accounts profile set --display-name "Saket" --timezone Asia/Kolkata
silicon-accounts profile set --photo ./me.png
silicon-accounts profile set --reset-photo

silicon-accounts profile show [OPTIONS]

silicon-accounts profile set [OPTIONS]

silicon-accounts profile set --display-name "Saket"
silicon-accounts profile set --timezone Europe/Berlin --dob 1999-04-01
silicon-accounts profile set --photo ./avatar.png

silicon-accounts email [OPTIONS] <COMMAND>

silicon-accounts email list
silicon-accounts email add work@example.com
silicon-accounts email verify 0192f0c2-… 123456
silicon-accounts email primary work@example.com
silicon-accounts email remove old@example.com

silicon-accounts email list [OPTIONS]

silicon-accounts email add [OPTIONS] <EMAIL>

silicon-accounts email verify [OPTIONS] <CHALLENGE_ID> <CODE>

silicon-accounts email primary [OPTIONS] <EMAIL>

silicon-accounts email remove [OPTIONS] <EMAIL>

silicon-accounts phone [OPTIONS] <COMMAND>

silicon-accounts phone add +919876543210
silicon-accounts phone add 98765 43210 --country IN
silicon-accounts phone verify 0192f0c2-… 123456

silicon-accounts phone list [OPTIONS]

silicon-accounts phone add [OPTIONS] <PHONE>

silicon-accounts phone verify [OPTIONS] <CHALLENGE_ID> <CODE>

silicon-accounts phone primary [OPTIONS] <PHONE>

silicon-accounts phone remove [OPTIONS] <PHONE>

silicon-accounts identities [OPTIONS] <COMMAND>

silicon-accounts identities list
silicon-accounts identities remove google 1098765432

silicon-accounts identities list [OPTIONS]

silicon-accounts identities remove [OPTIONS] <PROVIDER> <SUBJECT>

silicon-accounts apps [OPTIONS] <COMMAND>

silicon-accounts apps list
silicon-accounts apps remove briefcase

silicon-accounts apps list [OPTIONS]

silicon-accounts apps remove [OPTIONS] <APP_ID>

silicon-accounts proofs [OPTIONS] <COMMAND>

silicon-accounts proofs list
silicon-accounts proofs revoke 0192f0c2-…

silicon-accounts proofs list [OPTIONS]

silicon-accounts proofs revoke [OPTIONS] <PROOF_ID>

silicon-accounts sessions [OPTIONS] <COMMAND>

silicon-accounts sessions list
silicon-accounts sessions revoke 0192f0c2-…

silicon-accounts sessions list [OPTIONS]

silicon-accounts sessions revoke [OPTIONS] <ID>

silicon-accounts history [OPTIONS]

silicon-accounts history
silicon-accounts history --kind signin --limit 20
silicon-accounts history --json --cursor <next_cursor>

silicon-accounts silicon [OPTIONS] <COMMAND>

As a Carbon (you become the custodian):
  silicon-accounts silicon create --id si:scout --display-name Scout
As a Silicon (your custodian must accept):
  silicon-accounts silicon create --id si:scout --custodian c:saket --wait
  silicon-accounts silicon create --id si:scout --custodian saket@example.com \
      --webhook https://scout.example/hooks
  silicon-accounts silicon request status 0192f0c2-… --wait
Custodian tasks:
  silicon-accounts silicon list
  silicon-accounts silicon rotate-stk si:scout
  silicon-accounts silicon webhook deliveries si:scout --status failed
  silicon-accounts silicon transfer si:scout --to c:shubham
  silicon-accounts silicon delete si:scout --confirm si:scout

silicon-accounts silicon create [OPTIONS] --id <SI_ID>

silicon-accounts silicon create --id si:scout --display-name Scout
silicon-accounts silicon create --id si:scout --custodian c:saket --wait
silicon-accounts silicon create --id si:scout --custodian saket@example.com \
    --webhook https://scout.example/hooks
openssl rand -hex 16 | silicon-accounts silicon create --id si:scout --custodian c:saket --stk-stdin

silicon-accounts silicon list [OPTIONS]

silicon-accounts silicon show [OPTIONS] <SILICON>

silicon-accounts silicon update [OPTIONS] <SILICON>

silicon-accounts silicon update si:scout --display-name Scout
silicon-accounts silicon update si:scout --photo ./scout.png
silicon-accounts silicon update si:scout --timezone Europe/Paris --pfp-url
https://cdn.example.com/scout.png

silicon-accounts silicon id [OPTIONS] <SILICON> <NEW_ID>

silicon-accounts silicon rotate-stk [OPTIONS] <SILICON>

silicon-accounts silicon rotate-stk si:scout
printf 'stk-%s' "$(openssl rand -hex 16)" | silicon-accounts silicon rotate-stk si:scout --stk-stdin

silicon-accounts silicon webhook [OPTIONS] <COMMAND>

silicon-accounts silicon webhook set si:scout https://scout.example/hooks/accounts
silicon-accounts silicon webhook deliveries si:scout --status failed
silicon-accounts silicon webhook replay si:scout --failed
silicon-accounts silicon webhook remove si:scout

silicon-accounts silicon webhook set [OPTIONS] <SILICON> <URL>

silicon-accounts silicon webhook remove [OPTIONS] <SILICON>

silicon-accounts silicon webhook deliveries [OPTIONS] <SILICON>

silicon-accounts silicon webhook deliveries si:scout
silicon-accounts silicon webhook deliveries si:scout --status failed --json

silicon-accounts silicon webhook delivery [OPTIONS] <SILICON> <ID>

silicon-accounts silicon webhook replay [OPTIONS] <SILICON> [IDS]...

silicon-accounts silicon webhook replay si:scout --failed
silicon-accounts silicon webhook replay si:scout --failed --since 2026-10-01T00:00:00Z
silicon-accounts silicon webhook replay si:scout 0192f0c2-… 0192f0c3-…

silicon-accounts silicon apps [OPTIONS] <COMMAND>

silicon-accounts silicon apps list si:scout
silicon-accounts silicon apps remove si:scout briefcase
silicon-accounts silicon apps allow si:scout briefcase dm
silicon-accounts silicon apps allow si:scout --any
silicon-accounts silicon apps allowed si:scout

silicon-accounts silicon apps list [OPTIONS] <SILICON>

silicon-accounts silicon apps remove [OPTIONS] <SILICON> <APP_ID>

silicon-accounts silicon apps allow [OPTIONS] <SILICON> [APPS]...

silicon-accounts silicon apps allowed [OPTIONS] <SILICON>

silicon-accounts silicon keys [OPTIONS] <COMMAND>

silicon-accounts silicon keys add si:scout --generate ~/.accounts/scout.key --name laptop
silicon-accounts silicon keys add si:scout --public-key ~/.ssh/id_ed25519.pub
silicon-accounts silicon keys list si:scout
silicon-accounts silicon keys revoke si:scout 0192f0c2-…
silicon-accounts login --silicon si:scout --key ~/.accounts/scout.key

silicon-accounts silicon keys add [OPTIONS] <SILICON>

silicon-accounts silicon keys list [OPTIONS] <SILICON>

silicon-accounts silicon keys revoke [OPTIONS] <SILICON> <KEY_ID>

silicon-accounts silicon trust [OPTIONS] <COMMAND>

silicon-accounts silicon trust add si:scout --github acme/scout --claim ref=refs/heads/main
silicon-accounts silicon trust add si:scout --gitlab acme/scout --claim ref_type=branch --claim ref=main
silicon-accounts silicon trust add si:scout --issuer https://ci.example.com \
    --audience https://accounts.teamofsilicons.com --claim sub=pipeline:deploy
silicon-accounts silicon trust list si:scout
silicon-accounts silicon trust remove si:scout 0192f0c2-…

silicon-accounts silicon trust add [OPTIONS] <SILICON>

si:scout now trusts tokens from https://token.actions.githubusercontent.com for the audience https://accounts.teamofsilicons.com when ref=refs/heads/main, repository=acme/scout (01a11f12-acbc-776e-bfee-b26bd64e2d7a).

silicon-accounts silicon trust list [OPTIONS] <SILICON>

TRUST                                 ISSUER                                       CONDITIONS                                 LAST USED  STATE
01a11f12-acbc-776e-bfee-b26bd64e2d7a  https://token.actions.githubusercontent.com  ref=refs/heads/main repository=acme/scout  never      live

silicon-accounts silicon trust remove [OPTIONS] <SILICON> <TRUST_ID>

silicon-accounts silicon audiences [OPTIONS] <COMMAND>

silicon-accounts silicon audiences allow si:scout sts.amazonaws.com
silicon-accounts silicon audiences allow si:scout api://AzureADTokenExchange
silicon-accounts silicon audiences list si:scout
silicon-accounts silicon audiences remove si:scout sts.amazonaws.com

silicon-accounts silicon audiences list [OPTIONS] <SILICON>

silicon-accounts silicon audiences allow [OPTIONS] <SILICON> <AUDIENCES>...

si:scout may get identity tokens for: sts.amazonaws.com, api://AzureADTokenExchange.

silicon-accounts silicon audiences remove [OPTIONS] <SILICON> [AUDIENCES]...

silicon-accounts silicon signins [OPTIONS] <SILICON>

silicon-accounts silicon transfer [OPTIONS] --to <C_ID_OR_EMAIL> <SILICON>

silicon-accounts silicon cancel-transfer [OPTIONS] <SILICON>

silicon-accounts silicon delete [OPTIONS] <SILICON>

silicon-accounts silicon request [OPTIONS] <COMMAND>

silicon-accounts silicon request status [OPTIONS] <REQUEST_ID>

silicon-accounts silicon request status 0192f0c2-…
silicon-accounts silicon request status 0192f0c2-… --wait --timeout 2h

silicon-accounts webhook [OPTIONS] <COMMAND>

silicon-accounts webhook set https://scout.example/hooks/accounts
silicon-accounts webhook test
silicon-accounts webhook deliveries --status failed
silicon-accounts webhook delivery 0192f0c2-…
silicon-accounts webhook replay --failed
silicon-accounts webhook replay 0192f0c2-… 0192f0c3-…
silicon-accounts webhook remove

silicon-accounts webhook set [OPTIONS] <URL>

silicon-accounts webhook remove [OPTIONS]

silicon-accounts webhook test [OPTIONS]

silicon-accounts webhook deliveries [OPTIONS]

silicon-accounts webhook deliveries
silicon-accounts webhook deliveries --status failed --json

silicon-accounts webhook delivery [OPTIONS] <ID>

silicon-accounts webhook replay [OPTIONS] [IDS]...

silicon-accounts webhook replay --failed
silicon-accounts webhook replay --failed --since 2026-10-01T00:00:00Z
silicon-accounts webhook replay 0192f0c2-… 0192f0c3-…

silicon-accounts custodian [OPTIONS] <COMMAND>

silicon-accounts custodian requests
silicon-accounts custodian accept 0192f0c2-…
silicon-accounts custodian decline 0192f0c2-…

silicon-accounts custodian requests [OPTIONS]

silicon-accounts custodian accept [OPTIONS] <ID>

silicon-accounts custodian decline [OPTIONS] <ID>

silicon-accounts device [OPTIONS] <COMMAND>

silicon-accounts device show WDJB-MJHT
silicon-accounts device approve WDJB-MJHT

silicon-accounts device show [OPTIONS] <CODE>

silicon-accounts device approve [OPTIONS] <CODE>

silicon-accounts device deny [OPTIONS] <CODE>

silicon-accounts token [OPTIONS] <COMMAND>

silicon-accounts token identity --audience sts.amazonaws.com
silicon-accounts token identity --audience sts.amazonaws.com --ttl 900 > /tmp/web-identity-token
aws sts assume-role-with-web-identity --role-arn arn:aws:iam::123456789012:role/scout \
    --role-session-name scout \
    --web-identity-token "$(silicon-accounts token identity --audience sts.amazonaws.com)"

silicon-accounts token identity [OPTIONS] --audience <AUDIENCE>

silicon-accounts app [OPTIONS] <COMMAND>

printf '%s' "$SECRET" | silicon-accounts app use briefcase --secret-stdin
silicon-accounts app show
silicon-accounts app config set - <<< '{"methods":{"google":true}}'
silicon-accounts app users --q saket
silicon-accounts app import users.csv --default-country US --wait
silicon-accounts app token exchange --code sac_… --code-verifier … \
    --redirect-uri https://briefcase.example/callback
silicon-accounts app token slt slt_…
silicon-accounts app proof user-verification --subject-token eyJ… --to briefcase --scope files.write
silicon-accounts app proof verify sap_… && echo valid
silicon-accounts app webhook set https://briefcase.example/webhooks
silicon-accounts app webhook replay --failed

silicon-accounts app use [OPTIONS] <APP_ID>

printf '%s' "$SECRET" | silicon-accounts app use briefcase --secret-stdin
silicon-accounts app use briefcase          (as its owner)

silicon-accounts app list [OPTIONS]

silicon-accounts app new [OPTIONS]

silicon-accounts app show [OPTIONS]

silicon-accounts app config [OPTIONS] <COMMAND>

silicon-accounts app config get [OPTIONS]

silicon-accounts app config set [OPTIONS] <FILE>

silicon-accounts app config set patch.json --expected-version 7
echo '{"required_fields":["email"],"branding":{"radius":12}}' | silicon-accounts app config set -

silicon-accounts app config history [OPTIONS]

silicon-accounts app users [OPTIONS]

$ silicon-accounts app users --status deleted
UUID  ID  NAME             STATUS   SOURCE  CONTACT  LAST SIGN-IN
K1E       Deleted account  deleted  slt              2026-10-07T05:22:30Z

silicon-accounts app user [OPTIONS] <UUID>

silicon-accounts app import [OPTIONS] [FILE]
silicon-accounts app import <COMMAND>

silicon-accounts app import status [OPTIONS] <JOB>

silicon-accounts app import rows [OPTIONS] <JOB>

silicon-accounts app import list [OPTIONS]

silicon-accounts app token [OPTIONS] <COMMAND>

silicon-accounts app token exchange [OPTIONS] --code <CODE> --redirect-uri <URI>

silicon-accounts app token slt [OPTIONS] <SLT>

silicon-accounts app token refresh [OPTIONS] <REFRESH_TOKEN>

silicon-accounts app token introspect [OPTIONS] <TOKEN>

silicon-accounts app token revoke [OPTIONS] <TOKEN>

silicon-accounts app token verify [OPTIONS] <ACCESS_TOKEN>

silicon-accounts app userinfo [OPTIONS] <ACCESS_TOKEN>

silicon-accounts app proof [OPTIONS] <COMMAND>

silicon-accounts app proof user-verification [OPTIONS] --subject-token <TOKEN> --to <APP_ID>

silicon-accounts app proof user-verification --subject-token "$ACCESS_TOKEN" --to briefcase \
    --scope files.write --ttl 600

silicon-accounts app proof app-verification [OPTIONS] --to <APP_ID>

silicon-accounts app proof app-verification --to remind --ttl 300
silicon-accounts app proof app-verification --to waveform --scope notifications.send
silicon-accounts app proof list --kind app_verification

silicon-accounts app proof verify [OPTIONS] <TOKEN>

silicon-accounts app proof verify sap_… --json
silicon-accounts app proof verify - < token.txt && echo valid

silicon-accounts app proof refresh [OPTIONS] <REFRESH_TOKEN>

silicon-accounts app proof revoke [OPTIONS] [PROOF_ID]

silicon-accounts app proof list [OPTIONS]

silicon-accounts app webhook [OPTIONS] <COMMAND>

silicon-accounts app webhook set [OPTIONS] <URL>

silicon-accounts app webhook remove [OPTIONS]

silicon-accounts app webhook rotate [OPTIONS]

silicon-accounts app webhook test [OPTIONS]

silicon-accounts app webhook deliveries [OPTIONS]

silicon-accounts app webhook delivery [OPTIONS] <ID>

silicon-accounts app webhook replay [OPTIONS] [IDS]...

silicon-accounts app webhook replay 0192f0c2-… 0192f0c3-…
silicon-accounts app webhook replay --failed --since 2026-10-01T00:00:00Z

silicon-accounts app subscription [OPTIONS] <COMMAND>

silicon-accounts app subscription list
silicon-accounts app subscription create stream
silicon-accounts app subscription create webhook https://briefcase.example/webhooks --update id_change --update account_deleted
silicon-accounts app subscription update 0192f0c2-… --pause
silicon-accounts app subscription update 0192f0c2-… --all-updates --resume
silicon-accounts app subscription test 0192f0c2-…
silicon-accounts app subscription delete 0192f0c2-…

silicon-accounts app subscription list [OPTIONS]

silicon-accounts app subscription show [OPTIONS] <ID>

silicon-accounts app subscription create [OPTIONS] <DELIVERY> [URL]

silicon-accounts app subscription update [OPTIONS] <ID>

silicon-accounts app subscription delete [OPTIONS] <ID>

silicon-accounts app subscription test [OPTIONS] <ID>

silicon-accounts app lookup [OPTIONS] <TARGET>

silicon-accounts config [OPTIONS] <COMMAND>

silicon-accounts config get
silicon-accounts config home /srv/scout
silicon-accounts config set url http://127.0.0.1:8590
silicon-accounts config telemetry off

silicon-accounts config home [OPTIONS] [DIR]

silicon-accounts config home
silicon-accounts config home /srv/silicons/scout
silicon-accounts config home --reset

silicon-accounts config get [OPTIONS] [KEY]

silicon-accounts config set [OPTIONS] <KEY> <VALUE>

silicon-accounts config unset [OPTIONS] <KEY>

silicon-accounts config telemetry [OPTIONS] <STATE>

silicon-accounts report [OPTIONS] <MESSAGE>

silicon-accounts report "login --app remind returns 500 (request id 0192…)"
silicon-accounts report "wrong hint for login_locked" \
    --pr https://github.com/teamofsilicons/silicon-accounts/pull/42

silicon-accounts docs [OPTIONS] [TOPIC]

silicon-accounts docs
silicon-accounts docs silicons
silicon-accounts docs proofs

silicon-accounts help [OPTIONS] [TOPIC]...

silicon-accounts delete-account [OPTIONS]

silicon-accounts delete-account --confirm c:saket