Skip to content
SHC Docs

shc auth login

shc auth login

Section titled “shc auth login”

log in to a cluster via browser SSO

Synopsis

Section titled “Synopsis”

Open a browser to complete an OAuth 2.0 device-authorization login and persist the resulting tokens for subsequent CLI calls. On first contact the cluster’s CA is pinned trust-on-first-use; pass —ca-fingerprint to verify the pin against an out-of-band sha256, or —ca to supply a trusted bundle yourself. For headless CI/service accounts, pass —client-credentials with —client-id/—client-secret (or SHC_CLIENT_ID/SHC_CLIENT_SECRET) to run a client_credentials grant instead.

shc auth login [flags]

Examples

Section titled “Examples”
  shc auth login
  shc auth login --url https://cloud.example.com --tenant acme
  shc auth login --url https://cloud.example.com \
      --ca-fingerprint sha256:AB:CD:EF:12:34:56
  shc auth login --client-credentials --client-id ci-bot --client-secret s3c

Options

Section titled “Options”
      --ca string               path to a CA bundle for TLS verification (power-user override; disables auto-pin)
      --ca-fingerprint string   expected sha256 of the cluster CA (sha256:AB:CD:...); verifies the trust-on-first-use auto-pin
      --client-credentials      non-interactive login via the OAuth2 client_credentials grant (CI/service accounts)
      --client-id string        confidential client id for --client-credentials (env SHC_CLIENT_ID)
      --client-secret string    confidential client secret for --client-credentials (env SHC_CLIENT_SECRET)
  -h, --help                    help for login
      --insecure                skip TLS verification (insecure; prints a warning)
      --tenant string           tenant realm to authenticate against (default master)
      --url string              cluster base URL (https://...); defaults to the active context url

Options inherited from parent commands

Section titled “Options inherited from parent commands”
      --config stringArray   extra YAML config file to layer on top of auto-discovered config; repeatable, later files win
  -d, --debug                enable debug mode (default: $SHC_DEBUG)
  -e, --environment string   environment name (default: $SHC_ENVIRONMENT)
      --exclude string       comma-separated dotted paths to drop
      --fields string        comma-separated columns/keys to show (and their order)
      --filter string        comma-separated dotted paths to keep (drops everything else)
  -o, --output string        output format: tty|text|json|yaml (default: $SHC_OUTPUT)
  -s, --stack string         stack name (default: $SHC_STACK)
  -v, --verbose              verbose output (default: $SHC_VERBOSE)

SEE ALSO

Section titled “SEE ALSO”
  • shc auth - authenticate the CLI against a cluster