Signing in

Sign in

source-coop auth login

This opens your browser. After you sign in, the CLI keeps the session in your OS keyring, or in a file if there is no keyring. The old name, source-coop login, also works.

One session is used for all commands:

• creds exchanges the session's ID token at the data proxy for S3 credentials, for each role.
• Commands that use the source.coop API send the session's access token.

The CLI renews expired tokens and credentials. You sign in again only when the session itself expires.

Sign-in uses the OAuth2 Authorization Code flow with PKCE. The CLI then exchanges the OIDC ID token at the proxy's STS endpoint for temporary AWS credentials. Two flags change this:

• Without offline_access in --scope, the CLI cannot renew anything. You must sign in again when the credentials expire.
• With --no-cache, the CLI prints the credentials (in --format) and keeps nothing.

Sign in on a remote server (no browser)

auth login receives the browser's redirect on a local port. On a server without a browser, forward that port over SSH:

1. Connect with a port forward. Any free port is satisfactory; this example uses 8400:

   ssh -L 8400:127.0.0.1:8400 user@server
   

2. On the server, sign in on the forwarded port:

   source-coop auth login --port 8400
   

3. Open the URL that the CLI prints in your local browser, and sign in. The redirect to http://127.0.0.1:8400/callback goes through the tunnel to the CLI on the server.

The session stays on the server (see File fallback). source-coop creds renews the credentials there without a browser.

See your sign-in status

source-coop auth status

auth status shows:

• If you are signed in, and the account. The CLI found the account when you signed in. A session from an older version does not have it, and auth status tells you to sign in again.
• When the cached tokens and the role's credentials expire.
• A profile link on the site of the session (https://staging.source.coop for staging).

It reads only the cache. It does not renew tokens or use the network. On a terminal, the session's state is green or red.

When you must sign in again. The refresh token sets this. The CLI uses it to renew the other tokens and the credentials, so their expiry times do not matter. source.coop's identity provider (Ory) does not tell the CLI how long a refresh token lasts. Thus auth status shows:

• When the refresh token was last renewed. Each renewal starts its lifetime again.
• An estimate, to the day, of when it expires if not used. The estimate assumes 30 days, Ory's default. If the server uses a different lifetime, set SOURCE_REFRESH_TOKEN_LIFETIME (for example 720h or 14d). This changes only the estimate. If the CLI cannot read the value, it ignores it and shows a warning.

If a provider gives an expiry time, auth status shows that time. After that time, the session shows as expired. After only the estimate, it shows as likely expired (yellow), because the real lifetime can be longer. A session from an older version shows yes until its next renewal.

With --json, auth status prints the same data:

• logged_in is false when the session has expired. It stays true when the session is only likely expired.
• Times are RFC 3339, each with an expired flag.
• The account includes its profile_url.
• If the provider gave no refresh-token expiry, estimated_lapse_at and the assumed_lifetime it uses are included.

source-coop auth status --json | jq -r .login.refresh_token.issued_at

auth status shows one environment and one role, because the keyring cannot list its entries. To see others, use --proxy-url and --role-arn (or SOURCE_PROXY_URL and SOURCE_ROLE_ARN).

Sign out

auth logout removes the session of one environment and the credentials of one role. It removes them from the keyring and from the file fallback.

source-coop auth logout
source-coop auth logout --proxy-url https://data.staging.source.coop --role-arn reader-role
source-coop auth logout --json   # {"proxy_url": …, "role_arn": …, "removed": {"session": true, "credentials": true}}

It uses --proxy-url (SOURCE_PROXY_URL) and --role-arn (SOURCE_ROLE_ARN), as creds does.

The keyring cannot list its entries, so the credentials of other roles stay. You can use them until they expire, but the CLI cannot renew them without the session. To remove them now, run auth logout --role-arn <role> for each role.

auth logout does not revoke tokens at the identity provider.