Log in

One command signs you in and provisions the local credentials the platform needs — your identity for the control plane and per-registry tokens for put, npm, go, and oci.

Authentication uses the OAuth 2.0 device authorization flow: the CLI prints a URL and a code, you approve in a browser, and the CLI stores a short-lived token locally. You do not paste secrets into the terminal.

Sign in

putnami cloud login

The CLI opens the verification URL in your browser (use --no-open to print it instead), waits for approval, then stores your session. On success it also writes the per-registry credential recipes, so putnami can publish to and pull from the registries without further setup.

Want to… Do this
Print the URL instead of opening a browser putnami cloud login --no-open
Use a non-default OAuth client putnami cloud login --client-id <id>
Request specific scopes putnami cloud login --scope "openid profile email apikeys:write"

The default scope includes apikeys:write, which is required to mint the per-registry personal access tokens.

Check who you are

putnami cloud whoami

Add --output=jsonl for machine-readable output.

Tokens for scripts and CI

Interactive login is for humans. For automation, mint a bearer for a specific purpose and pass it to the tool that needs it. Each call emits a fresh, bare token on stdout — nothing else — so it is safe to capture.

putnami cloud token --for cache      # remote build cache
putnami cloud token --for registry   # put.putnami.dev (alias: put)
putnami cloud token --for npm        # npm.putnami.dev
putnami cloud token --for go         # go.putnami.dev
putnami cloud token --for oci        # oci.putnami.dev
putnami cloud token --global --output=json  # fresh bearer for platform-operator routes

To manage the stored per-registry personal access tokens directly:

putnami cloud registries          # set up / show status
putnami cloud registries --output=jsonl   # machine-readable status

Identity & access

Your session is an OIDC identity issued by auth.putnami.cloud. Access is scoped, not global:

  • Scopes on your token bound what a session may do (for example, apikeys:write to mint registry tokens).
  • Registry access rides per-registry personal access tokens, provisioned at login and mintable on demand with putnami cloud token.
  • Workspace access is granted per workspace; you operate the workspaces your identity is entitled to.

Workloads validate these tokens offline against the auth server's JWKS and fail closed on anything they cannot verify.

Sign out

putnami cloud logout

This revokes the server-side registry tokens it can reach and removes the local credentials. Run it from a session that is still valid so the remote tokens are revoked, not just the local files.

Next