> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/secrets-manager/secrets-manager-command-line-interface/init-command.md).

# Init Command

**Description:** Initialize a One-Time Access Token

**Parameters:**

Sub-command to run

format: **`ksm init <sub-command>`**

**Sub-Commands:**

| Sub-Command | Description                                            |
| ----------- | ------------------------------------------------------ |
| `default`   | Return the redeemed token as base64 encoded JSON       |
| `k8s`       | Return the redeemed token as Kubernetes secret script. |

{% hint style="warning" %}
Both `default` and `k8s` take the One-Time Access Token as a plain command-line argument (`ksm init default <TOKEN>`, `ksm init k8s <TOKEN>`), with no environment-variable alternative. The token will appear in shell history and, briefly, in the process list (for example `ps aux` on Linux) for any user able to inspect it. The token is single-use. Redeem it as soon as it is generated, and run this command in a private, trusted shell session.
{% endhint %}

## **default**

Initialize a One-Time Access Token and create a configuration profile for use with external integrations like GitHub Actions, Terraform and others. The output of the configuration can be generated as either base64 encoded JSON (default), or k8s format. Other KSM Developer SDKs, and applications, will understand configurations in this format.

`ksm init default <TOKEN>`

optional parameters:

* `--plain` do not base64 encode the configuration. Return plain JSON.
* `-h, --hostname` change the hostname
* `--skip-ssl-verify` - Do not verify the remote SSL certificate.

```
$ ksm init default XX:XXXX

ewogICAgImNsaWVudElkIjogInd ... U1R4eUQrU3ZNbkhrMTVLUHRGS2MrZlZJOGtlOUtL==
```

## k8s

Initialize a One-Time Access Token into a Kubernetes secret script.

`ksm init k8s <TOKEN>`

optional parameters:

* `--name, -n` Name of the Kubernetes secret. Default is **ksm-config**. The name must use lowercase letters, numbers, `-`, or `.`. Each `.`-separated label must start and end with a letter or a number. The name must not exceed 253 characters (the RFC 1123 subdomain rule Kubernetes applies to Secret names). The CLI rejects an invalid name immediately, before it redeems the One-Time Access Token.
* `--namespace, --ns` Name of the Kubernetes namespace. Default is **default**.
* `--apply` Automatically use kubectl to apply the secret. You will not see the secret script.
* `--immutable, -i` Make the secret immutable. Requires Kubernetes >= 1.21
* `-h, --hostname` change the hostname
* `--skip-ssl-verify` - Do not verify the remote SSL certificate.

```
$ ksm init k8s XX:XXXX

apiVersion: v1
data
  config: ewogICAgImNsaWVudElkIjogIml ... dWJsaWNLZXlJZCI6ICIxMCIKfQ==
kind: Secret
metadata:
  name: 'ksm-config'
  namespace: 'default'
type: Opaque
```

Some names are legal Kubernetes Secret names but ambiguous in YAML 1.1 (for example `y`, `n`, `1e5`). The CLI quotes these names the same way. This makes `kubectl apply` read them as strings, not as a boolean or number.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.keeper.io/keeperpam/secrets-manager/secrets-manager-command-line-interface/init-command.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.