diff --git a/src/cli/README.md b/src/cli/README.md
index 988715adb..df8a75327 100644
--- a/src/cli/README.md
+++ b/src/cli/README.md
@@ -90,7 +90,8 @@ Done
 - [preferrouterid](#preferrouterid-routerid)
 - [prefix](#prefix)
 - [promiscuous](#promiscuous)
-- [pskc](#pskc--p-keypassphrase)
+- [pskc](#pskc)
+- [pskcref](#pskcref)
 - [radiofilter](#radiofilter)
 - [rcp](#rcp)
 - [region](#region)
@@ -2349,7 +2350,7 @@ Done
 
 ### pollperiod
 
-Get the customized data poll period of sleepy end device (milliseconds). Only for certification test
+Get the customized data poll period of sleepy end device (milliseconds). Only for certification test.
 
 ```bash
 > pollperiod
@@ -2359,13 +2360,23 @@ Done
 
 ### pollperiod \<pollperiod\>
 
-Set the customized data poll period for sleepy end device (milliseconds >= 10ms). Only for certification test
+Set the customized data poll period for sleepy end device (milliseconds >= 10ms). Only for certification test.
 
 ```bash
 > pollperiod 10
 Done
 ```
 
+### pskc
+
+Get pskc in hex format.
+
+```bash
+> pskc
+00000000000000000000000000000000
+Done
+```
+
 ### pskc [-p] \<key\>|\<passphrase\>
 
 With `-p` generate pskc from \<passphrase\> (UTF-8 encoded) together with **current** network name and extended PAN ID, otherwise set pskc as \<key\> (hex format).
@@ -2377,6 +2388,29 @@ Done
 Done
 ```
 
+### pskcref
+
+Get pskc key reference.
+
+`OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE` is required.
+
+```bash
+> pskcref
+0x80000000
+Done
+```
+
+### pskcref \<keyref\>
+
+Set pskc key reference as \<keyref\>.
+
+`OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE` is required.
+
+```bash
+> pskcref 0x20017
+Done
+```
+
 ### preferrouterid \<routerid\>
 
 Prefer a Router ID when solicit router id from Leader.