Skip to main content
The CLI supports multiple authentication methods for different environments and use cases.

​
Interactive login

The default authentication method prints a URL and a confirmation code that you use to sign in from any browser.
This command:
  1. Prints a login URL and a six-digit confirmation code
  2. Waits while you open the URL, sign in, and enter the code
  3. Creates a default profile with your credentials
After successful authentication, the CLI is ready to use with your default profile.

​
Unattended authentication

For automation where no person is available to complete a sign-in (CI/CD pipelines, scripts, long-lived containers), use a service account token.
1

Create a service account

  1. Click Service Accounts in the left menu and click New (or use the Create dropdown in the upper right corner)
  2. Enter a unique name and optional description
  3. Click Next (Tags), add any optional tags, then click Create
See the Create a Service Account guide for details.
2

Generate a key

  1. Open the service account you created
  2. Click the Keys link
  3. Enter a key description and click Add
  4. Copy and download the generated key securely
3

Authenticate with the token

Use the token directly or create a profile:
For detailed service account token setup, see the Browser-less CLI Login guide.

​
Token management

​
View your current token

Display the token for a profile:

​
Override token for a single command

Use a different token without changing your profile:

​
Token precedence

The CLI uses tokens in this order:
  1. --token flag (highest priority)
  2. CPLN_TOKEN environment variable
  3. Profile token (default)

​
Authentication for CI/CD

For automated environments:
  1. Create a service account with appropriate permissions
  2. Generate a key and store it securely (e.g., CPLN_TOKEN in secrets manager)
  3. Create a profile in your CI/CD pipeline
See CI/CD usage for complete automation setup.

​
Troubleshooting

The confirmation code is valid for about 10 minutes. If it expires before you finish signing in, the CLI stops waiting and reports that the session expired. Run cpln login again to get a fresh URL and code.
The browser does not have to run on the same machine as the CLI. Copy the printed URL to a browser on any device, sign in, and enter the confirmation code — the waiting CLI picks up the credentials automatically.If no person is available to complete a sign-in at all, such as in a CI/CD pipeline, use a service account token instead.
A 403 error typically means one of the following:
  • Wrong org: You’re trying to access an org you don’t have access to, or there’s a typo in the org name. Verify with cpln profile get.
  • Missing token: No token is provided. Ensure CPLN_TOKEN is set or you’re using a profile with a valid token.
  • Insufficient permissions: Your token doesn’t have the required permissions. Generate a new key or re-login to refresh your token:
    Or for service accounts:
For more troubleshooting help, see the Troubleshooting page.

​
Next steps

Profiles

Manage multiple authentication contexts

CI/CD Setup

Automate with service accounts