Authentication

datumctl uses OAuth 2.0 and OpenID Connect (OIDC) with PKCE for secure authentication. You do not need to manage API keys.

Getting Started

Authentication happens through your browser and credentials are stored securely in your system keyring. To get going, run the following command, which will open your browser and guide you through authentication.

datumctl auth login

To see which users you have authenticated locally, use the list command:

datumctl auth list
# Alias: datumctl auth ls

This will output a table showing the Name, Email, and Status (Active or blank) for each set of stored credentials. Other authentication commands include:

• datumctl auth login
• datumctl auth list
• datumctl auth logout
• datumctl auth get-token
• datumctl auth update-kubeconfig
• datumctl auth switch

Switching Active User

If you have logged in with multiple user accounts (visible via datumctl auth list), you can switch which account is active using the switch command:

datumctl auth switch <user-email>

Replace <user-email> with the email address of the user you want to make active. This user must already be logged in.

After switching, subsequent commands that require authentication (like datumctl organizations list or kubectl operations configured via update-kubeconfig) will use the credentials of the newly activated user.

Logging Out

To remove stored credentials, use the logout command.

To logout a specific user, replace <user-email> with the email address shown in the datumctl auth list command.

datumctl auth logout <user-email>

To remove all Datum Cloud credentials stored by datumctl in your keyring, use the following command:

datumctl auth logout --all