Buildkite CLI auth command

The bk auth command allows you to manage authorization from the command line.

Commands

Command Description
bk auth login Login to Buildkite using OAuth or an API token
bk auth logout Logout and remove stored credentials
bk auth status Print the current user auth status
bk auth switch Switch to a different organization
bk auth token Print the stored API token for the current organization

Login auth

Login to Buildkite using OAuth or an API token

Authenticate with Buildkite using OAuth instead of manually creating an API token.

By default, the CLI requests all available scopes and Buildkite grants only those your account has permission for. Use --scopes to request a specific subset instead.

Scope groups can be used as shorthand for common permission sets:

read_only All read_* scopes (read-only access)

Groups can be mixed with individual scopes:

--scopes "read_only write_builds"

bk auth login [flags]

Flags

Flag Description
--credential-store="auto" Credential store for tokens: auto, keyring, or shm
--debug Log HTTP API traffic to stderr; bodies may contain sensitive data
--device Authenticate using OAuth device authorization instead of opening a browser callback
--org=STRING Organization slug for this invocation (overrides environment and configuration)
--scopes="" OAuth scopes to request
--token=STRING API token to store (non-OAuth login, requires --org)

Examples

Login with full permissions (inherits your account's scopes):

bk auth login

Login to a specific organization:

bk auth login --org my-org

Login non-interactively with an API token:

bk auth login --org my-org --token my-token

Login to a specific organization on a headless machine or remote shell:

bk auth login --device --org my-org

Login on a headless Linux host using an in-memory /dev/shm credential store:

bk auth login --device --credential-store shm

Or set the default once so 'bk auth login' uses /dev/shm without flags::

bk config set credential_store shm

bk auth login --device

Login with read-only access:

bk auth login --scopes read_only

Login with read-only plus write access to builds:

bk auth login --scopes "read_only write_builds"

Login with specific scopes:

bk auth login --scopes "read_user read_organizations read_clusters write_clusters"

Logout auth

Logout and remove stored credentials

bk auth logout [flags]

Flags

Flag Description
--all Log out of all organizations
--debug Log HTTP API traffic to stderr; bodies may contain sensitive data
--org=STRING Organization slug for this invocation (overrides environment and configuration)

Status auth

Print the current user auth status

It returns information on the current session.

bk auth status [flags]

Flags

Flag Description
-o, --output="" Output format. One of: json, yaml, text
--debug Log HTTP API traffic to stderr; bodies may contain sensitive data
--json Output as JSON
--org=STRING Organization slug for this invocation (overrides environment and configuration)
--text Output as text
--yaml Output as YAML

Examples

List the current token session:

bk auth status

Switch auth

Switch to a different organization

Select a configured organization.

bk auth switch [<organization-slug>]

Arguments

Argument Description
[<organization-slug>] Organization slug to switch

Flags

Flag Description
--debug Log HTTP API traffic to stderr; bodies may contain sensitive data
--org=STRING Organization slug for this invocation (overrides environment and configuration)

Examples

Switch the 'my-cool-org' configuration:

bk auth switch my-cool-org

Interactively select an organization:

bk auth switch

Token auth

Print the stored API token for the current organization

Prints the stored API token for the currently selected organization to stdout.

The token is retrieved from the configured credential store (or the BUILDKITE_API_TOKEN environment variable if set). This is useful for passing the token to other tools, for example:

bk auth token

Flags

Flag Description
--debug Log HTTP API traffic to stderr; bodies may contain sensitive data
--org=STRING Organization slug for this invocation (overrides environment and configuration)

Examples

Print the current token:

bk auth token

Use the token in a curl request:

curl -H "Authorization: Bearer $(bk auth token)" https://api.buildkite.com/v2/user