IAM

The hanzo iam commands.

Also for this capability: API · CLI · MCP · SDKs

Hanzo's identity provider: users, organizations, applications, and the OIDC/OAuth2 endpoints every Hanzo service authenticates against.

API reference →

hanzo iam keys list

Every command takes --json for the raw response and --help for its own flags. Sign in once with hanzo auth login; the commands below use that session, and the org they act in is the one it carries.

Command	What it does
`hanzo iam accounts`	Returns the people signed in on this browser, the most recent sign-in first — what the sign-in page lists when an application asks the person to choose an account.
`hanzo iam delete-membership`	Takes away a person's or an application's right to act in an organization.
`hanzo iam link`	Starts connecting another sign-in identity to the account you are already signed in as.
`hanzo iam linked-accounts`	Returns the sign-in identities linked to the calling person's account — every provider they can currently sign in with.
`hanzo iam login`	Signs a person in with the credential they typed, and — when the request is part of an OAuth flow — hands back the one-time code that finishes it.
`hanzo iam onboard`	Finishes setting up the account of whoever is calling — it creates their organization if they have none and puts them in it, so a person who has just signed up lands somewhere they can work.
`hanzo iam password`	Replaces the calling person's password.
`hanzo iam preferences`	Saves the calling person's own settings and returns the full set afterwards.
`hanzo iam signin`	Completes a sign-in: it exchanges the one-time code your application was handed at the end of the login flow for a live session, and returns the signed-in account.
`hanzo iam signup`	Creates an account from the sign-up form and applies the application's own sign-up rules — whether self-service registration is open at all, and which fields it requires.
`hanzo iam unlink`	Disconnects one sign-in identity from an account, so that provider can no longer be used to sign in as that person.
`hanzo iam verification-codes`	Validates the request and asks otp to get a code to the person.
`hanzo iam whoami`	Tells you who the current caller is — the lightweight check a page makes on load to decide whether to render signed-in or signed-out.

`.well-known`

Command	What it does
`hanzo iam .well-known jwks`	Publishes the public keys that verify the tokens issued here — the one URL you point a service at so it can check a token itself, offline, without calling back and without holding any secret of ours.
`hanzo iam .well-known oauth-authorization-server`	Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find every other endpoint on its own, instead of you configuring them by hand.
`hanzo iam .well-known openid-configuration`	Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find every other endpoint on its own, instead of you configuring them by hand.

Account

Command	What it does
`hanzo iam account get`	Returns the signed-in person's own account and the organization they belong to — what a console reads to draw the account menu.
`hanzo iam account replace`	Saves the calling person's own profile — the name they are shown by, their picture, a line about themselves and a link.

Admin

Command	What it does
`hanzo iam admin applications upsert`	Creates an application or updates it in place, so a deployment can declare the applications it needs and run the same declaration on every environment and on every redeploy.
`hanzo iam admin provision`	Sets up an account on someone's behalf — the same onboarding a person gets themselves, driven by one of your own services instead of by them.
`hanzo iam admin users upsert`	Creates a person or updates them in place, so a deployment can declare the accounts it needs and re-run that declaration safely.

Applications

Command	What it does
`hanzo iam applications create`	Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs.
`hanzo iam applications list --owner <owner>`	Returns the applications in one organization, newest first — each product or site your people sign in to, with the sign-in methods and redirect URIs it allows.
`hanzo iam applications owner get <owner> <name>`	Returns one application: its sign-in methods, its allowed redirect URIs and the client credentials your integration authenticates with.
`hanzo iam applications owner rm <owner> <name>`	Removes an application.
`hanzo iam applications owner set <owner> <name>`	Changes an application's display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.

Audit logs

Command	What it does
`hanzo iam audit-logs create`	Records an audit entry, so activity from your own systems lands in the same trail as everything the Hanzo Cloud records for you.
`hanzo iam audit-logs list`	Returns your organization's audit trail, newest first — who did what, when, and from where.
`hanzo iam audit-logs owner get <owner> <name>`	Returns one audit entry in full: the action, the person or key behind it, and the request it came in on.
`hanzo iam audit-logs owner rm <owner> <name>`	Removes an audit entry.
`hanzo iam audit-logs owner set <owner> <name>`	Corrects an audit entry.

Auth

Command	What it does
`hanzo iam auth application`	Returns everything a login screen needs to draw itself for one application: its branding, and each sign-in method it offers with the provider details that method needs.
`hanzo iam auth methods`	Returns the sign-in methods one application actually has switched on, so a login screen can render the right buttons for it without you hard-coding a list that drifts the moment you add a provider.

Certs

Command	What it does
`hanzo iam certs create`	Adds a signing certificate your applications can verify tokens against — the call you make to stage the next one before a rotation.
`hanzo iam certs list`	Returns your organization's signing certificates, newest first — the keys the tokens your applications verify are signed with.
`hanzo iam certs owner get <owner> <name>`	Returns one signing certificate — its algorithm, its validity window and its public half.
`hanzo iam certs owner rm <owner> <name>`	Removes a signing certificate.
`hanzo iam certs owner set <owner> <name>`	Changes a signing certificate's settings.

Command	What it does
`hanzo iam consent get`	Returns the calling person's own privacy and communication choices.
`hanzo iam consent replace`	Records the calling person's privacy and communication choices.

Invitations

Command	What it does
`hanzo iam invitations create`	Issues an invitation to join your organization — the code or link a new member redeems, with the role they arrive holding and the date it stops working.
`hanzo iam invitations list`	Returns your organization's invitations, newest first — who has been asked to join, on what terms, and how many seats each invitation still has left.
`hanzo iam invitations owner get <owner> <name>`	Returns one invitation: who it is for, what it grants on acceptance, and when it expires.
`hanzo iam invitations owner rm <owner> <name>`	Withdraws an invitation.
`hanzo iam invitations owner set <owner> <name>`	Changes an invitation's terms — the role it grants, how many may redeem it, or when it expires.

Keys

Command	What it does
`hanzo iam keys create`	Issues an API key.
`hanzo iam keys list`	Returns an organization's API keys, newest first — what each is called, what it may reach, its publishable half, and when it was last used.
`hanzo iam keys org`	Resolve a PUBLISHABLE key to the organization that owns it
`hanzo iam keys owner get <owner> <name>`	Returns one API key: what it is called, what it may reach, and when it was issued.
`hanzo iam keys owner rm <owner> <name>`	Revokes an API key.
`hanzo iam keys owner set <owner> <name>`	Changes what a key is called, what it may reach, when it expires, or revokes it.
`hanzo iam keys principal`	Resolve a SECRET key to the principal it authenticates

Memberships

Command	What it does
`hanzo iam memberships create`	Lets a person or an application act in an organization.
`hanzo iam memberships get`	Answers either question about who belongs where: which organizations one person can act in, or who can act in one organization.

MFA

Command	What it does
`hanzo iam mfa clear`	Turns a factor off, so sign-in stops asking for it.
`hanzo iam mfa preferred`	Picks which second factor an account is asked for first when it has more than one.
`hanzo iam mfa setup enable`	Finishes the enrolment: from here the account's sign-ins ask for this factor.
`hanzo iam mfa setup initiate`	Starts enrolling a factor and hands over whatever the person needs to prove they hold it.

OAuth

Command	What it does
`hanzo iam oauth authorize create`	Starts a sign-in — the address you send a browser to, and the beginning of every OAuth and OpenID Connect flow.
`hanzo iam oauth authorize get`	Starts a sign-in — the address you send a browser to, and the beginning of every OAuth and OpenID Connect flow.
`hanzo iam oauth callback`	Completes the round-trip: it resolves and burns the single-use transaction (checking expiry + browser binding), exchanges and verifies the IdP response, links or provisions the local user, and mints the iam authorization code the relying party expects — then redirects to the original redirect_uri with code + state.
`hanzo iam oauth device create`	Starts a sign-in on a device with no browser and no keyboard — a TV, a CLI, a headless box.
`hanzo iam oauth device info`	Answers "what am I approving?" for a pending device code.
`hanzo iam oauth federation mfa`	Completes a sign-in that came in through another identity provider and still owes a second factor.
`hanzo iam oauth introspect`	Answers whether an access token is still good, and what it is good for — the check a resource server of yours makes before honouring a token it did not mint.
`hanzo iam oauth logout create`	Ends a sign-in and sends the browser somewhere sensible.
`hanzo iam oauth logout get`	Ends a sign-in and sends the browser somewhere sensible.
`hanzo iam oauth refresh_token`	Exchanges what your application is holding for the tokens it needs — the one-time code from a finished sign-in, a refresh token, or your own client credentials when the caller is a program rather than a person.
`hanzo iam oauth revoke`	Retires a token before it expires — what you call when someone signs out or a credential may have leaked.
`hanzo iam oauth token`	Exchanges what your application is holding for the tokens it needs — the one-time code from a finished sign-in, a refresh token, or your own client credentials when the caller is a program rather than a person.
`hanzo iam oauth userinfo create`	Returns the profile claims for whoever the access token belongs to — the standard OpenID Connect way to find out who is calling you without your application storing anything itself.
`hanzo iam oauth userinfo get`	Returns the profile claims for whoever the access token belongs to — the standard OpenID Connect way to find out who is calling you without your application storing anything itself.

Organizations

Command	What it does
`hanzo iam organizations avatar`	Changes how an organization appears across Hanzo: the square mark beside its name, as an uploaded image or as a single emoji.
`hanzo iam organizations create`	Makes a new organization — the account your users, applications, roles, projects and workspaces are all named inside.
`hanzo iam organizations list`	Returns the organizations you can act in, the ones you belong to first and the rest after, newest first, narrowed by an optional query against the name or the display name.
`hanzo iam organizations owner get <owner> <name>`	Returns one organization: its display, its defaults and the sign-in rules everyone in it inherits.
`hanzo iam organizations owner rm <owner> <name>`	Removes an organization and everything named inside it.
`hanzo iam organizations owner set <owner> <name>`	Changes an organization's display, its defaults and the sign-in rules everyone in it inherits.
`hanzo iam organizations profile`	Changes how an organization reads: its display name, its website and its favicon.

Permissions

Command	What it does
`hanzo iam permissions create`	Grants a permission — the call that gives a person or a role the ability to do something.
`hanzo iam permissions list`	Returns the permissions in one organization, newest first — each one a grant saying which people or roles may do what, and to which resources.
`hanzo iam permissions owner get <owner> <name>`	Returns one permission: who it grants to, what it allows, and the resources it covers.
`hanzo iam permissions owner rm <owner> <name>`	Revokes a permission.
`hanzo iam permissions owner set <owner> <name>`	Changes who a permission grants to, what it allows, or the resources it covers.

Projects

Command	What it does
`hanzo iam projects create`	Makes a project inside your organization — the scope people pick between when their work is separated by product or client rather than by team.
`hanzo iam projects list`	Returns your organization's projects, newest first — the scope people pick between when their work is separated by product or client rather than by team.
`hanzo iam projects owner get <owner> <name>`	Returns one project: what it is called and how it is set up.
`hanzo iam projects owner rm <owner> <name>`	Removes a project.
`hanzo iam projects owner set <owner> <name>`	Changes a project's settings.

Providers

Command	What it does
`hanzo iam providers create`	Adds an identity provider your people can sign in with, or a service your applications send through — a social or enterprise login, an email or SMS sender, a storage or payment connector.
`hanzo iam providers list`	Returns your organization's providers, newest first — the identity providers your people sign in with, and the senders and connectors your applications go through.
`hanzo iam providers owner get <owner> <name>`	Returns one provider: what it connects to and how it is configured.
`hanzo iam providers owner rm <owner> <name>`	Removes a provider.
`hanzo iam providers owner set <owner> <name>`	Changes a provider's settings or rotates the credentials it holds.

Registry

Command	What it does
`hanzo iam registry jwks`	Publishes the public key your registry uses to verify the tokens issued above — the one URL to configure so the registry trusts logins without holding any secret of its own.
`hanzo iam registry token create`	Signs a container client in to your registry.
`hanzo iam registry token get`	Signs a container client in to your registry.

Roles

Command	What it does
`hanzo iam roles create`	Makes a role — a named group of people that permissions are granted to.
`hanzo iam roles list`	Returns your organization's roles, newest first — each a named group of people that permissions are granted to.
`hanzo iam roles owner get <owner> <name>`	Returns one role: who is in it, and the roles it includes.
`hanzo iam roles owner rm <owner> <name>`	Removes a role.
`hanzo iam roles owner set <owner> <name>`	Changes who is in a role, or which roles it includes.

SCIM

Command	What it does
`hanzo iam scim v2 ResourceTypes get <name>`	Returns one provisionable record kind in full.
`hanzo iam scim v2 ResourceTypes list`	Returns the kinds of record this directory provisions and the address of each, so your identity provider discovers them rather than having them configured by hand.
`hanzo iam scim v2 Schemas get <id>`	Returns one attribute definition in full.
`hanzo iam scim v2 Schemas list`	Returns the attribute definitions this directory understands, so your identity provider knows which fields it may send and what they mean before it sends any.
`hanzo iam scim v2 ServiceProviderConfig`	Tells your identity provider which parts of SCIM this directory supports, so it configures itself instead of you filling in a form.
`hanzo iam scim v2 Users create`	Provisions a person from your identity provider — how a new hire gets an account here automatically when they are added over there.
`hanzo iam scim v2 Users list`	Returns the people in your organization to your identity provider, in the standard SCIM shape, so an IdP can reconcile its directory against ours.
`hanzo iam scim v2 Users owner get <owner> <name>`	Returns one person in the standard SCIM shape.
`hanzo iam scim v2 Users owner rm <owner> <name>`	Deprovisions a person — how removing someone in your identity provider removes their access here.
`hanzo iam scim v2 Users owner set <owner> <name>`	Overwrites a person's SCIM attributes with what your identity provider sends — how a change made there lands here.
`hanzo iam scim v2 Users owner update <owner> <name>`	Applies a partial change from your identity provider — one attribute moved, not the whole record resent.

Service accounts

Command	What it does
`hanzo iam service-accounts create`	Makes a service account — an identity for a program rather than a person, for a script, a bot or a deployment that has to authenticate on its own.
`hanzo iam service-accounts keys <name>`	Serves POST /v1/iam/service-accounts/:name/keys: mint a fresh key, invalidating the prior one, and return the new raw secret exactly once.
`hanzo iam service-accounts list`	Returns your organization's service accounts — what each is called and when it was created.
`hanzo iam service-accounts rm <name>`	Serves DELETE /v1/iam/service-accounts/:name.

Sessions

Command	What it does
`hanzo iam sessions create --application <application> --name <name> --owner <owner>`	Records a sign-in and answers with the cookie id it minted.
`hanzo iam sessions list`	Returns who is currently signed in to an organization, newest first, and can be narrowed to one person or one application.
`hanzo iam sessions owner name get <owner> <name> <application>`	Returns one person's session in one application — when it began and which browsers or devices are still carrying it.
`hanzo iam sessions owner name rm <owner> <name> <application>`	Signs a person out of one application — the session ends and every browser carrying it stops being authenticated.
`hanzo iam sessions owner name set <owner> <name> <application>`	Names the browsers a session keeps — signing out the ones you leave off while the session itself stays live.

Teams

Command	What it does
`hanzo iam teams create`	Makes a team — a named set of people that roles and permissions grant to.
`hanzo iam teams get <name>`	Returns one team: who is in it.
`hanzo iam teams list`	Returns your organization's teams, newest first — each a named set of people that roles and permissions are granted to.
`hanzo iam teams rm <name>`	Removes a team.
`hanzo iam teams set <name>`	Changes who is in a team.

Tokens

Command	What it does
`hanzo iam tokens create`	Records an access token — the credential an application or integration presents on a caller's behalf.
`hanzo iam tokens issue`	Mints an access token for the `?id=<owner>/<name>` target user (optional `?aud=` resource, RFC 8707), issued by the authenticated + allow-listed confidential client.
`hanzo iam tokens list`	Returns the access tokens issued in your organization, newest first, and can be narrowed to one organization.
`hanzo iam tokens owner get <owner> <name>`	Returns one access token: who and what it was issued to, and when it expires.
`hanzo iam tokens owner rm <owner> <name>`	Revokes an access token.
`hanzo iam tokens owner set <owner> <name>`	Changes an access token's scope or expiry.

Users

Command	What it does
`hanzo iam users create`	Adds a person to your organization.
`hanzo iam users list`	Returns a page of the people in an organization, with the total so you can page through the rest.
`hanzo iam users owner get <owner> <name>`	Returns one person in your organization, addressed by their username or by their email address.
`hanzo iam users owner keys clear <owner> <name>`	Clears the target user's key of the requested TYPE (immediate revoke).
`hanzo iam users owner keys create <owner> <name>`	(re)generates the target user's key of the requested TYPE and returns it once, over the shared authorizeMinter + mintTarget seam.
`hanzo iam users owner rm <owner> <name>`	Removes a person from your organization.
`hanzo iam users owner set <owner> <name>`	Changes a person's profile, their roles, or the credentials they sign in with.

Web3

Command	What it does
`hanzo iam web3 nonce`	Starts a wallet sign-in: it returns a one-time challenge for the wallet to sign.
`hanzo iam web3 verify`	Completes a wallet sign-in: it verifies the signed challenge and, if it holds, signs the wallet's owner in.

WebAuthn

Command	What it does
`hanzo iam webauthn signin begin`	Starts a passkey sign-in: it returns the challenge the person's authenticator signs.
`hanzo iam webauthn signin finish`	Verifies the signed challenge and signs the person in.
`hanzo iam webauthn signup begin`	Starts enrolling a passkey for the signed-in person: it returns the options their browser hands to the authenticator.
`hanzo iam webauthn signup finish`	Verifies the newly created passkey and stores it, so the person can sign in with their device from then on.

WebAuthn credentials

Command	What it does
`hanzo iam webauthn-credentials create`	Registers a passkey or security key for a person, so they can sign in with their device instead of a password.
`hanzo iam webauthn-credentials list`	Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered.
`hanzo iam webauthn-credentials owner get <owner> <name>`	Returns one passkey or security key: whose it is, what device it lives on, and when it was registered.
`hanzo iam webauthn-credentials owner rm <owner> <name>`	Removes a passkey or security key — what you call when a device is lost.
`hanzo iam webauthn-credentials owner set <owner> <name>`	Renames a registered passkey or security key, so a person can tell their devices apart.

Workspaces

Command	What it does
`hanzo iam workspaces create`	Makes a workspace inside your organization — the scope a team works in, alongside projects rather than instead of them.
`hanzo iam workspaces list`	Returns your organization's workspaces, newest first — the scope a team works in, alongside projects rather than instead of them.
`hanzo iam workspaces owner get <owner> <name>`	Returns one workspace: what it is called and how it is set up.
`hanzo iam workspaces owner rm <owner> <name>`	Removes a workspace.
`hanzo iam workspaces owner set <owner> <name>`	Changes a workspace's settings.

Was this page useful?

PreviousCLI NextAccount