> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/secrets-manager/secrets-manager-command-line-interface/init-command.md).

# Init Command

Initialize a device to interact with the Secrets Manager API

**Description:** Initialize a One-Time Access Token

**Parameters:**

Sub-command to run

format: **`ksm init <sub-command>`**

**Sub-Commands:**

| Sub-Command | Description                                            |
| ----------- | ------------------------------------------------------ |
| `default`   | Return the redeemed token as base64 encoded JSON       |
| `k8s`       | Return the redeemed token as Kubernetes secret script. |

{% hint style="warning" %}
Both `default` and `k8s` take the One-Time Access Token as a plain command-line argument (`ksm init default <TOKEN>`, `ksm init k8s <TOKEN>`), with no environment-variable alternative. The token will appear in shell history and, briefly, in the process list (for example `ps aux` on Linux) for any user able to inspect it. The token is single-use. Redeem it as soon as it is generated, and run this command in a private, trusted shell session.
{% endhint %}

## **default**

Initialize a One-Time Access Token and create a configuration profile for use with external integrations like GitHub Actions, Terraform and others. The output of the configuration can be generated as either base64 encoded JSON (default), or k8s format. Other KSM Developer SDKs, and applications, will understand configurations in this format.

`ksm init default <TOKEN>`

optional parameters:

* `--plain` do not base64 encode the configuration. Return plain JSON.
* `-h, --hostname` change the hostname
* `--skip-ssl-verify` - Do not verify the remote SSL certificate.

```
$ ksm init default XX:XXXX

ewogICAgImNsaWVudElkIjogInd ... U1R4eUQrU3ZNbkhrMTVLUHRGS2MrZlZJOGtlOUtL==
```

## k8s

Initialize a One-Time Access Token into a Kubernetes secret script.

`ksm init k8s <TOKEN>`

optional parameters:

* `--name, -n` Name of the Kubernetes secret. Default is **ksm-config**. The name must use lowercase letters, numbers, `-`, or `.`. Each `.`-separated label must start and end with a letter or a number. The name must not exceed 253 characters (the RFC 1123 subdomain rule Kubernetes applies to Secret names). The CLI rejects an invalid name immediately, before it redeems the One-Time Access Token.
* `--namespace, --ns` Name of the Kubernetes namespace. Default is **default**.
* `--apply` Automatically use kubectl to apply the secret. You will not see the secret script.
* `--immutable, -i` Make the secret immutable. Requires Kubernetes >= 1.21
* `-h, --hostname` change the hostname
* `--skip-ssl-verify` - Do not verify the remote SSL certificate.

```
$ ksm init k8s XX:XXXX

apiVersion: v1
data
  config: ewogICAgImNsaWVudElkIjogIml ... dWJsaWNLZXlJZCI6ICIxMCIKfQ==
kind: Secret
metadata:
  name: 'ksm-config'
  namespace: 'default'
type: Opaque
```

Some names are legal Kubernetes Secret names but ambiguous in YAML 1.1 (for example `y`, `n`, `1e5`). The CLI quotes these names the same way. This makes `kubectl apply` read them as strings, not as a boolean or number.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.keeper.io/keeperpam/secrets-manager/secrets-manager-command-line-interface/init-command.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.