---
title: "oz0 tenant oidc"
description: "Usage and flags for oz0 tenant oidc."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/tenant/oidc"
---
# oz0 tenant oidc

> Usage and flags for oz0 tenant oidc.

For: Operators and developers looking up a command.

Each tenant has its own OIDC issuer on the edge: outside services and clouds trust its agents by the issuer and the token's subject, and fetch its keys from the issuer's discovery document. The edge mints a token only for a tool call it handed a node, through a connection of kind identity or on_behalf_of.

## Usage

```bash
oz0 tenant oidc [command]
```

## Subcommands

- [`delegated-off-cluster`](https://docs.oz0.ai/reference/cli/oz0/tenant/oidc/delegated-off-cluster)
- [`jwks`](https://docs.oz0.ai/reference/cli/oz0/tenant/oidc/jwks)
- [`publish`](https://docs.oz0.ai/reference/cli/oz0/tenant/oidc/publish)
- [`rotate`](https://docs.oz0.ai/reference/cli/oz0/tenant/oidc/rotate)
- [`show`](https://docs.oz0.ai/reference/cli/oz0/tenant/oidc/show)

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.