> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-platform/use-harness-cli/harness-cli/authenticate.md).

# Authenticate the Harness CLI

Log in to the Harness CLI, manage named profiles, set up authentication for CI, and enable shell completions.

The Harness CLI must be authenticated before it can access Harness resources. You can authenticate interactively for local development, use environment variables in automated environments, or manage multiple accounts and environments with named profiles.

***

## What you will learn in this topic <a href="#what-you-will-learn-in-this-topic" id="what-you-will-learn-in-this-topic"></a>

By the end of this page, you will know how to:

* Log in and create your first profile.
* Log in through your browser with single sign-on (SSO), and refresh or inspect an SSO token.
* Pass credentials through environment variables for CI and scripts.
* Create, list, switch, and remove named profiles.
* Set a default organization and project for a profile.
* Print the active auth context and API token for use in other tooling.
* Enable tab-completion for Bash and Zsh.
* Troubleshoot a browser login flow with SSO debug logging.

***

## Before you begin <a href="#before-you-begin" id="before-you-begin"></a>

* **Harness CLI installed:** For installation steps, see [Install and upgrade](/harness-platform/use-harness-cli/harness-cli/install-and-upgrade.md).
* **API key:** A Harness Personal Access Token (PAT) or Service Account token. Generate one from **My Profile** > **API Keys** or from a Service Account in the Harness UI.

***

## Log in <a href="#log-in" id="log-in"></a>

Run the login command to authenticate your CLI:

```sh
harness auth login
```

This command launches an interactive TUI wizard to collect your API URL, PAT or SAT token, account ID, and optional default organization and project. The CLI stores credentials and profile configuration locally for future use.

Confirm your authentication:

```sh
harness auth status
```

To authenticate through a browser with SSO instead of a PAT or SAT token, see [Login with SSO (single sign-on)](#login-with-sso).

### Named profiles <a href="#named-profiles" id="named-profiles"></a>

To create a profile for a different account or environment, pass the `--profile` flag:

```sh
harness auth login --profile staging
harness auth login --profile prod
```

### Non-interactive login <a href="#non-interactive-login" id="non-interactive-login"></a>

Log in without an interactive prompt by passing all values as flags. This is the recommended approach for CI pipelines:

```sh
harness auth login \
  --profile ci \
  --api-url  app.harness.io \
  --api-token "$HARNESS_API_KEY" \
  --account "$HARNESS_ACCOUNT" \
  --org default \
  --project my_project
```

For a fully non-interactive login, pass the API URL and token together:

```sh
harness auth login --api-url "$HARNESS_API_URL" --api-token "$HARNESS_API_KEY"
```

{% hint style="info" %}
The CLI resolves credentials in the following order: `--profile`, `HARNESS_API_KEY`, `HARNESS_PROFILE`, CI runner auto-detection, and the default profile in `~/.harness/config.yaml`. The first valid source is used.
{% endhint %}

***

## Login with SSO <a href="#login-with-sso" id="login-with-sso"></a>

Add `--sso` to authenticate through your browser with OAuth2 instead of pasting a token. Where the operating system provides a keychain, the CLI stores the resulting tokens there rather than on disk.

```sh
harness auth login --sso
harness auth login --sso --profile prod
```

### Check SSO token status <a href="#check-sso-token-status" id="check-sso-token-status"></a>

Show the token expiry and refresh status for the active profile.

```sh
harness auth sso_status --profile prod
```

### Refresh SSO token <a href="#refresh-sso-token" id="refresh-sso-token"></a>

Exchange the stored refresh token for a new access token. Run this when an SSO access token has expired but the session is still valid.

```sh
harness auth sso_refresh
```

### Troubleshoot a browser login <a href="#troubleshoot-a-browser-login" id="troubleshoot-a-browser-login"></a>

If a browser login does not complete, emit SSO auth debug events and retry the login.

```sh
harness debug sso-log
```

***

## Set environment variables <a href="#set-environment-variables" id="set-environment-variables"></a>

For CI pipelines, Docker containers, and automated scripts, set these environment variables instead of logging in interactively:

| Variable                  | Description                                                                         |
| ------------------------- | ----------------------------------------------------------------------------------- |
| `HARNESS_API_KEY`         | API token. Takes precedence over any saved profile.                                 |
| `HARNESS_ACCOUNT`         | Account ID. Required together with `HARNESS_API_KEY` for environment variable auth. |
| `HARNESS_PROFILE`         | Name of the saved profile to use. Same effect as `--profile <name>`.                |
| `HARNESS_ORG`             | Default org for commands that need one. Overridden by `--org`.                      |
| `HARNESS_DEFAULT_PROJECT` | Default project for commands that need one. Overridden by `--project`.              |
| `HARNESS_API_URL`         | Override the API URL. Typically only needed for self-hosted Harness deployments.    |

```sh
export HARNESS_API_KEY=pat.xxxxxxxxxxxxxxxxxx
export HARNESS_ACCOUNT=ZJL7VBAhRq6Pf9G4f5OqLg
export HARNESS_ORG=default
export HARNESS_PROJECT=my_project

harness list pipeline
```

When `HARNESS_API_KEY` is set, it takes precedence over any saved profile. For the full list of environment variables including output and behavior controls, see [Global flags and output](/harness-platform/use-harness-cli/harness-cli/global-flags-and-output.md#environment-variables).

{% hint style="info" %}
Environment variables are typically the preferred authentication method for CI/CD pipelines and other automated environments because they avoid storing credentials on disk.
{% endhint %}

***

## Manage profiles <a href="#manage-profiles" id="manage-profiles"></a>

A profile is a named set of credentials and default organization and project settings. Most teams maintain separate profiles for development, staging, and production environments.

### List and inspect <a href="#list-and-inspect" id="list-and-inspect"></a>

```sh
harness auth profiles                       # List every saved profile
harness auth status                         # Show the active profile
harness auth status --profile staging       # Inspect a specific profile
```

### Switch between profiles <a href="#switch-between-profiles" id="switch-between-profiles"></a>

Use a profile for a single command:

```sh
harness list pipeline --profile prod
```

Pin a profile for the entire shell session:

```sh
export HARNESS_PROFILE=prod
harness list pipeline   # Uses the prod profile
```

### Set a default organization and project <a href="#set-a-default-organization-and-project" id="set-a-default-organization-and-project"></a>

Set the default organization and project for a profile so you do not need to pass them on every command:

```sh
harness auth setscope --org my-org --project my-project
harness auth setscope --org my-org --project my-project --profile staging
```

Run `harness auth setscope` without flags to launch an interactive picker.

### Log out <a href="#log-out" id="log-out"></a>

Remove a profile and its stored credentials:

```sh
harness auth logout
harness auth logout --profile staging
```

***

## Export the auth context <a href="#export-the-auth-context" id="export-the-auth-context"></a>

Two commands print the active credentials so that other tooling can consume them.

### Print environment variables <a href="#print-environment-variables" id="print-environment-variables"></a>

Print the environment variables for the current auth context. Add `--export` to produce output you can pass to `eval`.

```sh
harness auth env
eval "$(harness auth env --export)"
```

### Print the API token <a href="#print-the-api-token" id="print-the-api-token"></a>

Print the active API token to stdout. Use this to pipe the token into another tool, such as `curl`.

```sh
harness auth token
curl -H "x-api-key: $(harness auth token)" <harness_api_url>
```

{% hint style="warning" %}
`harness auth token` writes a live credential to stdout. Do not log its output or store it in a file that is committed to version control.
{% endhint %}

***

## Configuration files <a href="#configuration-files" id="configuration-files"></a>

* The `~/.harness/config.yaml` file stores profiles, account IDs, default org and project.
* The `~/.harness/credentials` file stores API tokens per profile. These tokens are never logged or printed.

Override the config directory with the `HARNESS_CONFIG_HOME` environment variable.

***

## Shell completions <a href="#shell-completions" id="shell-completions"></a>

Tab-completion covers actions, resources, flags, and live identifiers fetched from the API.

### Zsh <a href="#zsh" id="zsh"></a>

```sh
source <(harness completion zsh)
```

Add to `.zshrc` for persistence:

```sh
echo 'source <(harness completion zsh)' >> ~/.zshrc
```

### Bash <a href="#bash" id="bash"></a>

```sh
source <(harness completion bash)
```

Add to `.bashrc` for persistence:

```sh
echo 'source <(harness completion bash)' >> ~/.bashrc
```

Shell completion supports actions, resources, identifiers, flags, and valid flag values. Resource identifiers are retrieved dynamically from the Harness API.

***

## Related articles <a href="#related-articles" id="related-articles"></a>

* [Supported resources and actions](/harness-platform/use-harness-cli/harness-cli/supported-resources-and-actions.md): Review every supported resource and action.
* [Global flags and output](/harness-platform/use-harness-cli/harness-cli/global-flags-and-output.md): Understand output formats, filtering, and pagination.

{% @harness-feedback/feedback module="harness-ai" pagePath="harness-ai/use-harness-cli/harness-cli/authenticate" %}