> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-platform/use-harness-cli/harness-cli/authenticate.md).

# Authenticate the Harness CLI

The Harness CLI must be authenticated before it can access Harness resources. You can authenticate interactively for local development, use environment variables in automated environments, or manage multiple accounts and environments with named profiles.

***

### What you will learn in this topic <a href="#what-you-will-learn-in-this-topic" id="what-you-will-learn-in-this-topic"></a>

By the end of this page, you will know how to:

* Log in and create your first profile.
* Log in through your browser with single sign-on (SSO), and refresh or inspect an SSO token.
* Pass credentials through environment variables for CI and scripts.
* Create, list, switch, and remove named profiles.
* Set a default organization and project for a profile.
* Print the active auth context and API token for use in other tooling.
* Enable tab-completion for Bash and Zsh.
* Troubleshoot a browser login flow with SSO debug logging.

***

### Before you begin <a href="#before-you-begin" id="before-you-begin"></a>

* **Harness CLI installed:** For installation steps, see [Install and upgrade](/harness-platform/use-harness-cli/harness-cli/install-and-upgrade.md).
* **API key:** A Harness Personal Access Token (PAT) or Service Account token. Generate one from **My Profile** > **API Keys** or from a Service Account in the Harness UI.

***

### Log in <a href="#log-in" id="log-in"></a>

Run the login command to authenticate your CLI:

```sh
harness auth login
```

This command launches an interactive prompt to collect your API token, account ID, and optional default organization and project. The CLI stores credentials and profile configuration locally for future use.

Confirm your authentication:

```sh
harness auth status
```

To create a profile for a different account or environment, pass the `--profile` flag:

```sh
harness auth login --profile staging
harness auth login --profile prod
```

You can also log in without an interactive prompt by passing all values as flags:

```sh
harness auth login \
  --profile ci \
  --api-token "$HARNESS_API_KEY" \
  --account "$HARNESS_ACCOUNT_ID" \
  --org default \
  --project my_project
```

For a fully non-interactive login, pass the API URL and token together:

```sh
harness auth login --api-url "$HARNESS_API_URL" --api-token "$HARNESS_API_KEY"
```

{% hint style="info" %}
The CLI resolves credentials in the following order: `--profile`, `HARNESS_API_KEY`, `HARNESS_PROFILE`, CI runner auto-detection, and the default profile in `~/.harness/config.yaml`. The first valid source is used.
{% endhint %}

***

### Log in with single sign-on <a href="#log-in-with-single-sign-on" id="log-in-with-single-sign-on"></a>

Add `--sso` to authenticate through your browser with OAuth2 instead of pasting a token. Where the operating system provides a keychain, the CLI stores the resulting tokens there rather than on disk.

```sh
harness auth login --sso
harness auth login --sso --profile prod
```

#### Check SSO token status <a href="#check-sso-token-status" id="check-sso-token-status"></a>

Show the token expiry and refresh status for the active profile.

```sh
harness auth sso_status
harness auth sso_status --profile prod
```

#### Refresh an SSO token <a href="#refresh-an-sso-token" id="refresh-an-sso-token"></a>

Exchange the stored refresh token for a new access token. Run this when an SSO access token has expired but the session is still valid.

```sh
harness auth sso_refresh
```

#### Troubleshoot a browser login <a href="#troubleshoot-a-browser-login" id="troubleshoot-a-browser-login"></a>

If a browser login does not complete, emit SSO auth debug events and retry the login.

```sh
harness debug sso-log
```

***

### Set environment variables <a href="#set-environment-variables" id="set-environment-variables"></a>

For CI pipelines, Docker containers, and automated scripts, set these environment variables instead of logging in interactively:

```sh
export HARNESS_API_KEY=pat.xxxxxxxxxxxxxxxxxx
export HARNESS_ACCOUNT_ID=ZJL7VBAhRq6Pf9G4f5OqLg
export HARNESS_DEFAULT_ORG=default
export HARNESS_DEFAULT_PROJECT=my_project

harness list pipeline
```

When `HARNESS_API_KEY` is set, it takes precedence over any saved profile.

{% hint style="info" %}
Environment variables are typically the preferred authentication method for CI/CD pipelines and other automated environments because they avoid storing credentials on disk.
{% endhint %}

***

### Manage profiles <a href="#manage-profiles" id="manage-profiles"></a>

A profile is a named set of credentials and default organization and project settings. Most teams maintain separate profiles for development, staging, and production environments.

#### List and inspect <a href="#list-and-inspect" id="list-and-inspect"></a>

```sh
harness auth profiles                       # List every saved profile
harness auth status                         # Show the active profile
harness auth status --profile staging       # Inspect a specific profile
```

#### Switch between profiles <a href="#switch-between-profiles" id="switch-between-profiles"></a>

Use a profile for a single command:

```sh
harness list pipeline --profile prod
```

Pin a profile for the entire shell session:

```sh
export HARNESS_PROFILE=prod
harness list pipeline   # Uses the prod profile
```

#### Set a default organization and project <a href="#set-a-default-organization-and-project" id="set-a-default-organization-and-project"></a>

Set the default organization and project for a profile so you do not need to pass them on every command:

```sh
harness auth setscope --org my-org --project my-project
harness auth setscope --org my-org --project my-project --profile staging
```

Run `harness auth setscope` without flags to launch an interactive picker.

#### Log out <a href="#log-out" id="log-out"></a>

Remove a profile and its stored credentials:

```sh
harness auth logout
harness auth logout --profile staging
```

***

### Export the auth context <a href="#export-the-auth-context" id="export-the-auth-context"></a>

Two commands print the active credentials so that other tooling can consume them.

#### Print environment variables <a href="#print-environment-variables" id="print-environment-variables"></a>

Print the environment variables for the current auth context. Add `--export` to produce output you can pass to `eval`.

```sh
harness auth env
eval "$(harness auth env --export)"
```

#### Print the API token <a href="#print-the-api-token" id="print-the-api-token"></a>

Print the active API token to stdout. Use this to pipe the token into another tool, such as `curl`.

```sh
harness auth token
curl -H "x-api-key: $(harness auth token)" <harness_api_url>
```

{% hint style="warning" %}
`harness auth token` writes a live credential to stdout. Do not log its output or store it in a file that is committed to version control.
{% endhint %}

***

### Configuration files <a href="#configuration-files" id="configuration-files"></a>

| File                     | What it stores                                   |
| ------------------------ | ------------------------------------------------ |
| `~/.harness/config.yaml` | Profiles, account IDs, default org and project   |
| `~/.harness/credentials` | API tokens per profile (never logged or printed) |

Override the config directory with the `HARNESS_CONFIG_HOME` environment variable.

***

### Shell completions <a href="#shell-completions" id="shell-completions"></a>

Tab-completion covers actions, resources, flags, and live identifiers fetched from the API.

#### Zsh <a href="#zsh" id="zsh"></a>

```sh
source <(harness completion zsh)
```

Add to `.zshrc` for persistence:

```sh
echo 'source <(harness completion zsh)' >> ~/.zshrc
```

#### Bash <a href="#bash" id="bash"></a>

```sh
source <(harness completion bash)
```

Add to `.bashrc` for persistence:

```sh
echo 'source <(harness completion bash)' >> ~/.bashrc
```

Shell completion supports actions, resources, identifiers, flags, and valid flag values. Resource identifiers are retrieved dynamically from the Harness API.

***

### Related articles <a href="#related-articles" id="related-articles"></a>

* [Supported resources and actions](/harness-platform/use-harness-cli/harness-cli/supported-resources-and-actions.md): Review every supported resource and action.
* [Global flags and output](/harness-platform/use-harness-cli/harness-cli/global-flags-and-output.md): Understand output formats, filtering, and pagination.