opschain admin users create
Included from Basic tier
Creates a local user. The password never travels on the command line: pass it via an environment variable name or a no-echo prompt, or pass no password flag at all and the server generates one — returned exactly once in the command's output and not retrievable again.
opschain admin users create emergency.admin --break-glass
Created emergency.admin (provider local, break-glass)
Password: <generated>
Store it now — it is shown exactly once and cannot be retrieved again.
Depending on the server's security posture, creating a user without
--break-glass may be refused outright (workforce identities belong to the
directory; local accounts exist as the break-glass fire door — the server's
422 explains this). Usernames must be 1-100 characters of lowercase
letters, digits, ., _, @ or -, starting with a letter or digit, and
may not shadow an existing directory identity.
Flags
| Flag | Meaning |
|---|---|
--password-env <NAME> | Name of an environment variable holding the new user's password (never pass the value itself on the command line). |
--password-prompt | Prompt for the password without echo (reads a line from stdin when piped). Mutually exclusive with the flag above. |
--break-glass | Designate the account break-glass: every successful login emits the never-throttled warn:auth:break_glass event. |
--group <name> | Local group to add the user to (repeatable). |
--server <url> | Server base URL (default: the active context / OPSCHAIN_SERVER). |
--auth-token <token> | Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login). |
With -o json|yaml the created user document is printed instead — it
carries the generated password, so treat that output as a secret.
Exit codes
- 0 — created.
- 1 — the server refused (posture, duplicate, shadow collision), or the admin token was rejected.
- 2 — usage, including the connection errors on
opschain docs cli/admin-users.
Named errors
--password-env and --password-prompt are mutually exclusive— exits 2.--password-env <NAME>: the environment variable is not set (or empty)— exits 2.no password provided (pipe it on stdin, or run from a terminal)— a prompt that read nothing; exits 2.
See also
opschain docs cli/admin-users-reset-password— the same password conventions on an existing user.opschain docs cli/admin-groups-add-member— group membership after creation.