Command Reference

Complete documentation for all Entra Token CLI commands, options, and arguments.

Command Overview

CommandDescription
get-tokenGenerate access tokens
refreshRefresh expired tokens
inspectDecode and inspect JWT tokens
discoverQuick token information
configManage authentication profiles
--helpDisplay help information
--versionShow version information

get-token

Generate an access token using a configured profile.

Synopsis 

1

entratool get-token [OPTIONS]

Options

OptionAliasRequiredDescription
--profile <NAME>-pYesProfile name to use
--scope <SCOPE>-sNoOverride profile scope
--flow <FLOW>-fNoOAuth2 flow to use
--silentNoSuppress output except token
--output <FILE>-oNoSave token to file
--jsonNoOutput as JSON

OAuth2 Flows

  • ClientCredentials - Service-to-service
  • AuthorizationCode - Web applications
  • DeviceCode - Limited-input devices
  • InteractiveBrowser - Desktop applications

Examples

Basic usage:

1

entratool get-token -p my-profile

Override scope:

1
2

entratool get-token -p my-profile \
  --scope "https://graph.microsoft.com/User.Read Mail.Read"

Specify flow:

1

entratool get-token -p my-profile -f ClientCredentials

Silent output (for scripts):

1

TOKEN=$(entratool get-token -p my-profile --silent)

Save to file:

1

entratool get-token -p my-profile -o token.txt

JSON output:

1

entratool get-token -p my-profile --json

Multiple scopes:

1
2

entratool get-token -p my-profile \
  --scope "https://graph.microsoft.com/User.Read,Mail.Read,Calendars.Read"

Device code flow:

1

entratool get-token -p headless-server -f DeviceCode

Interactive browser:

1

entratool get-token -p user-app -f InteractiveBrowser

Certificate authentication:

1

entratool get-token -p cert-profile -f ClientCredentials

Full documentation →

refresh

Refresh an expired access token using a refresh token.

Synopsis 

1

entratool refresh [OPTIONS]

Options

OptionAliasRequiredDescription
--profile <NAME>-pYesProfile name to use
--silentNoSuppress output except token
--output <FILE>-oNoSave token to file

Examples

Refresh token:

1

entratool refresh -p my-profile

Silent output:

1

TOKEN=$(entratool refresh -p my-profile --silent)

Save to file:

1

entratool refresh -p my-profile -o token.txt

Notes

  • Requires offline_access scope in original token request
  • Not available for Client Credentials flow
  • Refresh tokens expire after 90 days of inactivity

Full documentation →

inspect

Decode and display JWT token claims.

Synopsis 

1

entratool inspect [OPTIONS]

Options

OptionAliasRequiredDescription
--token <TOKEN>-tConditionalToken string to inspect
--file <FILE>-fConditionalFile containing token

Note: Provide either --token or --file, or pipe token via stdin.

Examples

Inspect token string:

1

entratool inspect -t "eyJ0eXAiOiJKV1Qi..."

Inspect from file:

1

entratool inspect -f token.txt

Inspect from pipeline:

1

entratool get-token -p my-profile --silent | entratool inspect

Extract specific claim:

1

entratool inspect -t "$TOKEN" | jq -r .payload.scp

Check expiration:

1

entratool inspect -t "$TOKEN" | jq -r .payload.exp

View all claims:

1

entratool inspect -f token.txt | jq

Full documentation →

discover

Quick token information and validation.

Synopsis 

1

entratool discover [OPTIONS]

Options

OptionAliasRequiredDescription
--token <TOKEN>-tConditionalToken string to discover
--file <FILE>-fConditionalFile containing token

Exit Codes

  • 0 - Token is valid
  • 1 - Token is expired or invalid

Examples

Discover token info:

1

entratool discover -t "eyJ0eXAiOiJKV1Qi..."

Check if token is valid:

1
2
3
4
5

if entratool discover -t "$TOKEN" &>/dev/null; then
  echo "Token is valid"
else
  echo "Token is expired"
fi

From file:

1

entratool discover -f token.txt

In script:

1
2
3
4

if ! entratool discover -f token.txt; then
  # Token expired, get new one
  entratool get-token -p my-profile --silent > token.txt
fi

Full documentation →

config

Manage authentication profiles.

Synopsis 

1

entratool config <SUBCOMMAND> [OPTIONS]

Subcommands

SubcommandDescription
createCreate new profile
listList all profiles
editEdit existing profile
deleteDelete profile
exportExport profile(s)
importImport profile(s)

config create

Create a new authentication profile interactively.

Synopsis:

1

entratool config create

Example:

1
2
3
4
5
6
7
8
9

entratool config create

# Interactive prompts:
# - Profile name
# - Client ID
# - Tenant ID
# - Authentication method
# - Scope
# - OAuth2 flow (optional)

config list

List all configured profiles.

Synopsis:

1

entratool config list [OPTIONS]

Options:

OptionDescription
--jsonOutput as JSON

Examples:

1
2
3
4
5

# List profiles
entratool config list

# JSON output
entratool config list --json

config edit

Edit an existing profile interactively.

Synopsis:

1

entratool config edit [OPTIONS]

Options:

OptionAliasRequiredDescription
--profile <NAME>-pYesProfile name to edit

Example:

1
2
3
4
5
6
7
8
9

entratool config edit -p my-profile

# Select what to edit:
# - Client ID
# - Tenant ID
# - Client Secret
# - Scope
# - OAuth2 Flow
# - Authority URL

config delete

Delete a profile and its associated secrets.

Synopsis:

1

entratool config delete [OPTIONS]

Options:

OptionAliasRequiredDescription
--profile <NAME>-pYesProfile name to delete
--forceNoSkip confirmation

Examples:

1
2
3
4
5

# Delete with confirmation
entratool config delete -p my-profile

# Delete without confirmation
entratool config delete -p my-profile --force

config export

Export profile configuration (without secrets).

Synopsis:

1

entratool config export [OPTIONS]

Options:

OptionAliasRequiredDescription
--profile <NAME>-pNoProfile name (omit for all)
--output <FILE>-oYesOutput file path

Examples:

1
2
3
4
5

# Export single profile
entratool config export -p my-profile -o profile.json

# Export all profiles
entratool config export -o all-profiles.json

config import

Import profile configuration from file.

Synopsis:

1

entratool config import [OPTIONS]

Options:

OptionAliasRequiredDescription
--file <FILE>-fYesFile to import

Example:

1

entratool config import -f profile.json

Full config documentation →

--help

Display help information.

Synopsis 

1
2

entratool --help
entratool <COMMAND> --help

Examples

General help:

1

entratool --help

Command-specific help:

1
2
3

entratool get-token --help
entratool config --help
entratool config create --help

--version

Display version information.

Synopsis 

1

entratool --version

Output:

                 _             _              _
  ___ _ __  _ __| |_ _ __ __ _| |_ ___   ___ | |
 / _ \ '_ \| '__| __| '__/ _` | __/ _ \ / _ \| |
|  __/ | | | |  | |_| | | (_| | || (_) | (_) | |
 \___|_| |_|_|   \__|_|  \__,_|\__\___/ \___/|_|

version 1.0.0

Global Options

Available for all commands:

OptionDescription
--helpDisplay help
--versionDisplay version
--verboseEnable verbose output
--no-colorDisable colored output

Exit Codes

CodeMeaning
0Success
1General error
2Invalid arguments
3Authentication failed
4Profile not found
5Token expired
6Network error

Environment Variables

VariableDescriptionExample
AZURE_CLIENT_IDDefault client ID12345678-...
AZURE_TENANT_IDDefault tenant ID87654321-...
AZURE_CLIENT_SECRETClient secretabc123...
ENTRATOOL_CONFIG_PATHConfig directory~/.entratool

Configuration Files

Profile Configuration

Location: ~/.entratool/profiles.json

Format:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

{
  "profiles": [
    {
      "name": "my-profile",
      "clientId": "12345678-1234-1234-1234-123456789abc",
      "tenantId": "87654321-4321-4321-4321-cba987654321",
      "scope": "https://graph.microsoft.com/.default",
      "flow": "ClientCredentials",
      "useClientSecret": true
    }
  ]
}

Secure Storage

Secrets location:

  • Windows: DPAPI-encrypted store
  • macOS: Keychain (~/Library/Keychains/login.keychain-db)
  • Linux: ~/.entratool/secrets.dat (⚠️ XOR obfuscated)

Common Command Patterns

Script Integration 

1
2
3
4
5
6
7
8
9

#!/bin/bash
set -euo pipefail

# Get token
TOKEN=$(entratool get-token -p automation --silent)

# Use token
curl -H "Authorization: Bearer $TOKEN" \
     https://graph.microsoft.com/v1.0/me

Token Caching 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

TOKEN_FILE="/tmp/cached-token.txt"

# Check if token is valid
if ! entratool discover -f "$TOKEN_FILE" &>/dev/null; then
  # Get fresh token
  entratool get-token -p my-profile --silent > "$TOKEN_FILE"
  chmod 600 "$TOKEN_FILE"
fi

TOKEN=$(cat "$TOKEN_FILE")

Multi-Environment 

1
2
3
4
5
6
7
8

# Development
entratool get-token -p dev-profile -f ClientCredentials

# Staging
entratool get-token -p staging-profile -f ClientCredentials

# Production
entratool get-token -p prod-profile -f ClientCredentials

Error Handling 

1
2
3
4
5
6
7
8

if ! TOKEN=$(entratool get-token -p my-profile --silent 2>&1); then
  echo "Error: Failed to get token"
  echo "$TOKEN"
  exit 1
fi

# Use token
curl -H "Authorization: Bearer $TOKEN" ...

Next Steps