ykclient [\,OPTION\/]... \,CLIENTID YUBIKEYOTP\/


Validate the YUBIKEYOTP one-time-password against the YubiCloud using CLIENTID as the client identifier.

Mandatory arguments to long options are mandatory for short options too.


Display this help screen


Display version information


Print debugging information

--url URL

Validation service URL, for example, ""

--ca CADIR

Path to directory containing Certificate Authoritity, e.g., "/usr/local/etc/CERTS"

--apikey Key

API key for HMAC validation of request/response

Exit status is 0 on success, 1 if there is a hard failure, 2 if the OTP was replayed, 3 for other soft OTP-related failures.


Report bugs at <>.