ykman(1)

Usage

ykman [OPTIONS] COMMAND [ARGS] ...

Overview

Configure your YubiKey via the command line.

Options

-d, --device SERIAL: specify which YubiKey to interact with by serial number

-r, --reader NAME: specify a YubiKey by smart card reader name (can't be used with --device or list)

-t, --scp-ca FILENAME: specify the CA to use to verify the SCP11 card key (CA-KLCC)

-s, --scp CRED: specify private key and certificate chain for secure messaging, can be used multiple times to provide key and certificates in multiple files (private key, certificates in leaf-last order), OR SCP03 keys in hex separated by colon (:) K-ENC:K-MAC[:K-DEK]

-p, --scp-password PASSWORD: specify a password required to access the --scp file, if needed

-l, --log-level [ERROR|WARNING|INFO|DEBUG|TRAFFIC]: enable logging at given verbosity level

--log-file FILE: write log to FILE instead of printing to stderr (requires --log-level)

--diagnose: show diagnostics information useful for troubleshooting

-v, --version: show version information about the app

--full-help: show --help output, including hidden commands

-h, --help: show this message and exit

Commands:

`info`	show general information
`list`	list connected YubiKeys
`script`	run a python script
`config`	configure the YubiKey, enable or disable applications
`fido`	manage the FIDO applications
`hsmauth`	manage the YubiHSM Auth application
`oath`	manage the OATH application
`openpgp`	manage the OpenPGP application
`otp`	manage the YubiOTP application
`piv`	manage the PIV application

Examples

List connected YubiKeys, only output serial number:

$ ykman list --serials

Show information about YubiKey with serial number 123456:

$ ykman --device 123456 info

Shell completion

Experimental shell completion for the command line tool is available. To enable it, run this command once (for Bash):

$ source <(_YKMAN_COMPLETE=bash_source ykman | sudo tee /etc/bash_completion.d/ykman)

More information on shell completion (including instructions for other shells) is available at: https://click.palletsprojects.com/en/stable/shell-completion/

Releases

4 releases since Debian 10 (Buster); the text changed 3 times.

10
11
12
13

--device since Debian 13 (Trixie); --diagnose since Debian 13 (Trixie); --full-help since Debian 13 (Trixie); --help since Debian 13 (Trixie); --log-file since Debian 13 (Trixie); --log-level since Debian 13 (Trixie); --reader since Debian 13 (Trixie); --scp since Debian 13 (Trixie); --scp-ca since Debian 13 (Trixie); --scp-password since Debian 13 (Trixie); --version since Debian 13 (Trixie); -d since Debian 13 (Trixie); -h since Debian 13 (Trixie); -l since Debian 13 (Trixie); -p since Debian 13 (Trixie); -r since Debian 13 (Trixie); -s since Debian 13 (Trixie); -t since Debian 13 (Trixie); -v since Debian 13 (Trixie).