Skip to main content
The Ory Kratos CLI provides a comprehensive set of commands for managing your identity infrastructure. Use the CLI to run the Kratos server, manage identities, perform database migrations, and execute various administrative tasks.

​
Installation

The Kratos CLI is distributed as a single binary. You can install it using one of the following methods: 
brew install ory/tap/kratos

​
Command structure

The Kratos CLI follows a hierarchical command structure: 
kratos [command] [subcommand] [flags]

​
Main commands

  • serve - Run the Ory Kratos server
  • migrate - Database migration helpers
  • get - Get resources (identities)
  • list - List resources (identities)
  • delete - Delete resources (identities)
  • import - Import resources (identities)
  • validate - Validate resources (identity files)
  • cleanup - Cleanup helpers for database maintenance
  • courier - Message courier commands
  • hashers - Password hashing helpers
  • format - Code formatting helpers (JSONNet)
  • version - Display version information

​
Global flags

The following flags are available across multiple commands:

​
Configuration flags

These flags are available for commands that interact with the Kratos configuration:
  • --config - Path to the configuration file
  • --config-dir - Directory containing configuration files

​
Client flags

These flags are available for commands that interact with the Kratos API:
  • --endpoint, -e - The URL of Ory Kratos’ Admin API (can also be set via KRATOS_ADMIN_URL environment variable)
  • --format - Set the output format (json, yaml, json-pretty, or table)

​
Output flags

  • --format - Output format (json, yaml, json-pretty, jsonpath, table)
  • --quiet, -q - Suppress output

​
Getting help

You can get help for any command by using the --help flag: 
kratos --help
For help with a specific command: 
kratos serve --help
kratos migrate sql --help
kratos get identity --help

​
Environment variables

The CLI respects the following environment variables:
Environment variables provide a convenient way to configure the CLI without passing flags every time.

​
KRATOS_ADMIN_URL

Sets the default endpoint for the Kratos Admin API. This is used by identity management commands. 
export KRATOS_ADMIN_URL=http://localhost:4434
kratos list identities

​
DSN

Database connection string used by migration and cleanup commands. 
export DSN=postgres://user:pass@localhost:5432/kratos
kratos migrate sql -e

​
Common workflows

​
Running the server

kratos serve --config /path/to/config.yml

​
Managing identities

# List all identities
kratos list identities --format json

# Get a specific identity
kratos get identity <identity-id>

# Delete an identity
kratos delete identity <identity-id>

# Import identities from a file
kratos import identities identity.json

​
Database operations

# Run migrations
kratos migrate sql postgres://user:pass@localhost:5432/kratos --yes

# Check migration status
kratos migrate sql status postgres://user:pass@localhost:5432/kratos

# Cleanup old records
kratos cleanup sql postgres://user:pass@localhost:5432/kratos

​
Next steps

Serve command

Learn how to run the Kratos server with various configuration options

Identity commands

Manage identities using the CLI

Migrate command

Perform database migrations and schema updates

Configuration

Configure Ory Kratos

Build docs developers (and LLMs) love

Get started for freeTalk to us