Authentication

Signing in is OAuth2 with PKCE, through your browser. There is no API key to paste and no client secret shipped in the package.

Signing in

cf auth login
cf auth login --force

The command opens your browser, starts a listener on localhost for the callback, and waits. --force signs in again over an existing session. If the browser does not open on its own, the URL is printed for you to open yourself.

$cf auth statusSigned in to https://cefense.com  you@example.com  token in the macOS Keychain  github connected as acme-eng

Where the session is stored

In your operating system keychain: the macOS Keychain, Windows Credential Manager, or the system keyring on Linux. cf auth status tells you which one is holding it.

Tokens for CI and containers

export CEFENSE_TOKEN=<token>
cf status

CEFENSE_TOKEN takes precedence over anything stored, is read straight from the environment, and is never written to disk. This is the supported way to run in CI, where cf auth login cannot work because there is no browser. See Running in CI.

Signing out

cf auth logout
cf auth logout --all

Signing out revokes the token at the identity provider and forgets it locally. --all does that for every instance you have signed in to.

Talking to a different instance

cf status --api-url https://cefense.example.com
export CEFENSE_API_URL=http://localhost:3001

Credentials are stored per instance, so signing in to one does not sign you in to another. The default is https://cefense.com.