---
name: "keystone"
section: "1"
platform: "linux"
package: "python-keystoneclient"
version: "1:0.10.1-2+deb8u1"
release: "Debian 8 (Jessie)"
platforms: ["linux"]
url: "https://new.carta.tech/keystone"
---

# keystone(1)

Client for OpenStack Identity API

## NAME

keystone - Client for OpenStack Identity API

## SYNOPSIS

**keystone** \[options\] \<command\> \[command-options\]

**keystone help**

**keystone help** \<command\>

## DESCRIPTION

The **keystone** command line utility interacts with services providing OpenStack Identity API (e.g. Keystone).

To communicate with the API, you will need to be authenticated - and the **keystone** provides multiple options for this.

While bootstrapping keystone the authentication is accomplished with a shared secret token and the location of the Identity API endpoint. The shared secret token is configured in keystone.conf as "admin\_token".

You can specify those values on the command line with *--os-token* and *--os-endpoint*, or set them in environment variables:

- **OS\_SERVICE\_TOKEN**

  Your keystone administrative token

- **OS\_SERVICE\_ENDPOINT**

  Your Identity API endpoint

The command line options will override any environment variables set.

If you already have accounts, you can use your OpenStack username and password. You can do this with the *--os-username*, *--os-password*.

Keystone allows a user to be associated with one or more projects which are historically called tenants.  To specify the project for which you want to authorize against, you may optionally specify a *--os-tenant-id* or *--os-tenant-name*.

Instead of using options, it is easier to just set them as environment variables:

- **OS\_USERNAME**

  Your Keystone username.

- **OS\_PASSWORD**

  Your Keystone password.

- **OS\_TENANT\_NAME**

  Name of Keystone project.

- **OS\_TENANT\_ID**

  ID of Keystone Tenant.

- **OS\_AUTH\_URL**

  The OpenStack API server URL.

- **OS\_IDENTITY\_API\_VERSION**

  The OpenStack Identity API version.

- **OS\_CACERT**

  The location for the CA truststore (PEM formatted) for this client.

- **OS\_CERT**

  The location for the keystore (PEM formatted) containing the public key of this client.  This keystore can also optionally contain the private key of this client.

- **OS\_KEY**

  The location for the keystore (PEM formatted) containing the private key of this client.  This value can be empty if the private key is included in the OS\_CERT file.

For example, in Bash you'd use:

```
export OS_USERNAME=yourname
export OS_PASSWORD=yadayadayada
export OS_TENANT_NAME=myproject
export OS_AUTH_URL=http(s)://example.com:5000/v2.0/
export OS_IDENTITY_API_VERSION=2.0
export OS_CACERT=/etc/keystone/yourca.pem
export OS_CERT=/etc/keystone/yourpublickey.pem
export OS_KEY=/etc/keystone/yourprivatekey.pem
```

## OPTIONS

To get a list of available commands and options run:

```
keystone help
```

To get usage and options of a command:

```
keystone help <command>
```

## EXAMPLES

Get information about endpoint-create command:

```
keystone help endpoint-create
```

View endpoints of OpenStack services:

```
keystone catalog
```

Create a 'service' project:

```
keystone tenant-create --name=service
```

Create service user for nova:

```
keystone user-create --name=nova \
                     --tenant_id=<project ID> \
                     --email=nova@nothing.com
```

View roles:

```
keystone role-list
```

## BUGS

Keystone client is hosted in Launchpad so you can view current bugs at *https://bugs.launchpad.net/python-keystoneclient/*.

## AUTHOR

OpenStack Contributors

## COPYRIGHT

OpenStack Contributors