> ## Documentation Index
> Fetch the complete documentation index at: https://datum-4926dda5-mintlify-style-consistency-1774830500.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

`datumctl` uses OAuth 2.0 and OpenID Connect (OIDC) with PKCE for secure authentication. You do not need to manage API keys.

## Getting Started

Authentication happens through your browser and credentials are stored securely in your system keyring. To get going, run the following command, which will open your browser and guide you through authentication.

```text theme={null}
datumctl auth login
```

To see which users you have authenticated locally, use the `list` command:

```text theme={null}
datumctl auth list
# Alias: datumctl auth ls
```

This will output a table showing the Name, Email, and Status (Active or blank) for each set of stored credentials.  Other authentication commands include:

* `datumctl auth login`
* `datumctl auth list`
* `datumctl auth logout`
* `datumctl auth get-token`
* `datumctl auth update-kubeconfig`
* `datumctl auth switch`

## Switching Active User

If you have logged in with multiple user accounts (visible via `datumctl auth list`), you can switch which account is active using the `switch` command:

```text theme={null}
datumctl auth switch <user-email>
```

Replace `<user-email>` with the email address of the user you want to make active. This user must already be logged in.

After switching, subsequent commands that require authentication (like `datumctl organizations list` or `kubectl` operations configured via `update-kubeconfig`) will use the credentials of the newly activated user.

## Logging Out

To remove stored credentials, use the `logout` command.

To logout a specific user, replace `<user-email>` with the email address shown in the `datumctl auth list` command.

```text theme={null}
datumctl auth logout <user-email>
```

To remove all Datum Cloud credentials stored by `datumctl` in your keyring, use the following command:

```text theme={null}
datumctl auth logout --all
```