sysand auth login#

Store a bearer token for an index.

Usage#

sysand auth login [OPTIONS] [INDEX_URL]

Description#

Stores a bearer token for an index in the operating system’s keyring, so later sysand commands authenticate to that index without any per-session setup. The token is read from a hidden prompt, or from standard input with --token-stdin, never from a command-line argument (which would leak it into shell history).

Without [INDEX_URL], the command targets the default index, echoing the resolved index before the prompt and erroring if the default-index chain is ambiguous. Only HTTP(S) index URLs can be logged in to.

The token is always validated against the index before it is stored, and the output states which surfaces accepted it, for example validated (read) or validated (api). For the probing rules, the refusal behavior, and the stored, not validated outcome, see Login validation.

The stored credential is scoped to URL patterns derived from the index URL and its discovery configuration, printed on the Covers line; see Credential scope. A URL template is accepted as the index URL; the credential is then scoped to the template’s literal prefix.

Logging in again to the same index replaces the stored token. On a host without a usable keyring, the command refuses to persist the token and prints the SYSAND_CRED_* environment variables to set instead, with a <token> placeholder in place of the secret.

If standard input is not a terminal and --token-stdin was not given, the command fails fast instead of hanging:

error: no terminal for prompt; pass the token with `--token-stdin`

Arguments#

  • [INDEX_URL]: Index URL to log in to (e.g. https://sysand.com). URL templates are accepted. Defaults to the default index.

Options#

  • --token-stdin: Read the token from standard input (trimming one trailing newline) instead of prompting

Global options#

  • -v, --verbose: Use verbose output

  • -q, --quiet: Do not output log messages

  • --no-config: Disable discovery of configuration files [env: SYSAND_NO_CONFIG]

  • --config-file <CONFIG_FILE>: Give path to sysand.toml to use for configuration [env: SYSAND_CONFIG_FILE]

  • -h, --help: Print help

Examples#

Log in to an index with an API, such as sysand.com. The token is typed into a hidden prompt and checked against the API before it is stored:

$ sysand auth login https://sysand.com
  Logging in to index `https://sysand.com/`
Enter token for `https://sysand.com/`:
      Stored credential for `https://sysand.com/` (validated (api))
      Covers https://sysand.com/**

A URL template is accepted as the index URL, for logging in to a private index read through a forge’s files API; the how-to Authenticate to an index walks through a GitLab example.

Pipe the token from a secret manager instead of typing it:

$ my-secret-manager get sysand-token | sysand auth login https://sysand.com --token-stdin

See also#