Skip to main content
The CLI stores a JWT access token in ~/.infraudit/config.yaml after you log in. All subsequent commands use that token automatically — you do not need to pass credentials on every invocation.

​
Commands

​
auth login

Log in with your email and password. If you omit the flags, the CLI prompts you interactively:

​
auth register

Create a new InfraAudit account. Prompts interactively if flags are not provided:

​
auth whoami

Display the currently authenticated user:

​
auth logout

Clear the stored credentials from the config file:

​
Token refresh

The CLI refreshes the access token automatically using the stored refresh_token. If both tokens expire — for example, after a long period of inactivity — run infraudit auth login again.

​
API token authentication

For non-interactive environments where you need a stable, long-lived credential, use an API token:
The token is stored in ~/.infraudit/config.yaml under auth.token and used as a Bearer credential on every request.
API tokens can be generated in the InfraAudit web platform under Settings → API Tokens.

​
CI/CD usage

For automated pipelines, pass credentials via flags sourced from CI secrets rather than committing credentials or copying config files:
Alternatively, authenticate using an API token stored as a CI secret:
See CI/CD usage for a complete GitHub Actions example.

​
Security notes

Do not commit ~/.infraudit/config.yaml to source control. It contains your access token.
  • Credentials are stored with 0600 file permissions (owner read/write only).
  • Each team member should maintain their own config file with their own credentials.
  • Rotate API tokens from the web platform if a token is compromised.