|
| 1 | +# Authentication |
| 2 | + |
| 3 | +The Tigris CLI supports multiple authentication methods. When more than one is configured, the CLI uses the first match in the following priority order: |
| 4 | + |
| 5 | +| Priority | Method | How to set up | |
| 6 | +|----------|--------|---------------| |
| 7 | +| 1 | AWS Profile | `AWS_PROFILE` env var + `~/.aws/credentials` | |
| 8 | +| 2 | Environment variables (AWS_) | `AWS_ACCESS_KEY_ID` + `AWS_SECRET_ACCESS_KEY` | |
| 9 | +| 3 | Environment variables (TIGRIS_) | `TIGRIS_STORAGE_ACCESS_KEY_ID` + `TIGRIS_STORAGE_SECRET_ACCESS_KEY` | |
| 10 | +| 4 | OAuth login | `tigris login` or `tigris login oauth` | |
| 11 | +| 5 | Credentials login | `tigris login credentials` | |
| 12 | +| 6 | Configured credentials | `tigris configure` | |
| 13 | + |
| 14 | +Run `tigris whoami` to see which method is currently active. |
| 15 | + |
| 16 | +## OAuth Login |
| 17 | + |
| 18 | +The recommended method for interactive use. Opens a browser for authentication via OAuth2 device flow. |
| 19 | + |
| 20 | +```sh |
| 21 | +tigris login |
| 22 | +# or explicitly: |
| 23 | +tigris login oauth |
| 24 | +``` |
| 25 | + |
| 26 | +OAuth sessions support organization management (`tigris orgs list`, `tigris orgs select`) and IAM operations (users, policies). Tokens are refreshed automatically. |
| 27 | + |
| 28 | +## Credentials Login |
| 29 | + |
| 30 | +Creates a temporary session using an access key and secret. The session is cleared on `tigris logout`, but credentials saved via `tigris configure` are preserved. |
| 31 | + |
| 32 | +```sh |
| 33 | +tigris login credentials --access-key tid_AaBb --access-secret tsec_XxYy |
| 34 | +# or interactively: |
| 35 | +tigris login credentials |
| 36 | +``` |
| 37 | + |
| 38 | +## Configured Credentials |
| 39 | + |
| 40 | +Saves access key credentials permanently to `~/.tigris/config.json`. These persist across login/logout cycles and are used as a fallback when no other login method is active. |
| 41 | + |
| 42 | +```sh |
| 43 | +tigris configure --access-key tid_AaBb --access-secret tsec_XxYy |
| 44 | +``` |
| 45 | + |
| 46 | +You can optionally specify a custom endpoint: |
| 47 | + |
| 48 | +```sh |
| 49 | +tigris configure --access-key tid_AaBb --access-secret tsec_XxYy --endpoint https://custom.endpoint.dev |
| 50 | +``` |
| 51 | + |
| 52 | +## Environment Variables |
| 53 | + |
| 54 | +Environment variables act as per-session overrides and take priority over stored login state. This is useful for CI/CD pipelines, scripts, and testing with different credentials without affecting your local config. |
| 55 | + |
| 56 | +### AWS-standard variables (highest priority) |
| 57 | + |
| 58 | +```sh |
| 59 | +export AWS_ACCESS_KEY_ID=tid_AaBb |
| 60 | +export AWS_SECRET_ACCESS_KEY=tsec_XxYy |
| 61 | +# Optional: override the storage endpoint |
| 62 | +export AWS_ENDPOINT_URL_S3=https://t3.storage.dev |
| 63 | +``` |
| 64 | + |
| 65 | +### Tigris-specific variables |
| 66 | + |
| 67 | +```sh |
| 68 | +export TIGRIS_STORAGE_ACCESS_KEY_ID=tid_AaBb |
| 69 | +export TIGRIS_STORAGE_SECRET_ACCESS_KEY=tsec_XxYy |
| 70 | +# Optional: override the storage endpoint |
| 71 | +export TIGRIS_STORAGE_ENDPOINT=https://t3.storage.dev |
| 72 | +``` |
| 73 | + |
| 74 | +When both AWS_ and TIGRIS_ variables are set, AWS_ takes priority. |
| 75 | + |
| 76 | +### Endpoint variables |
| 77 | + |
| 78 | +You can override service endpoints independently: |
| 79 | + |
| 80 | +| Variable | Description | Default | |
| 81 | +|----------|-------------|---------| |
| 82 | +| `AWS_ENDPOINT_URL_S3` | Storage endpoint | `https://t3.storage.dev` | |
| 83 | +| `AWS_ENDPOINT_URL_IAM` | IAM endpoint | `https://iam.storageapi.dev` | |
| 84 | +| `TIGRIS_STORAGE_ENDPOINT` | Storage endpoint | `https://t3.storage.dev` | |
| 85 | +| `TIGRIS_IAM_ENDPOINT` | IAM endpoint (fallback) | `https://iam.storageapi.dev` | |
| 86 | + |
| 87 | +AWS_ endpoint variables take priority over TIGRIS_ endpoint variables. |
| 88 | + |
| 89 | +## AWS Profile |
| 90 | + |
| 91 | +If you have Tigris credentials configured in `~/.aws/credentials`, the CLI picks them up automatically when `AWS_PROFILE` is set. |
| 92 | + |
| 93 | +```ini |
| 94 | +# ~/.aws/credentials |
| 95 | +[tigris] |
| 96 | +aws_access_key_id = tid_AaBb |
| 97 | +aws_secret_access_key = tsec_XxYy |
| 98 | +``` |
| 99 | + |
| 100 | +```ini |
| 101 | +# ~/.aws/config |
| 102 | +[profile tigris] |
| 103 | +endpoint_url_s3 = https://t3.storage.dev |
| 104 | +region = auto |
| 105 | +``` |
| 106 | + |
| 107 | +```sh |
| 108 | +export AWS_PROFILE=tigris |
| 109 | +tigris ls |
| 110 | +``` |
| 111 | + |
| 112 | +## Checking Auth Status |
| 113 | + |
| 114 | +```sh |
| 115 | +tigris whoami |
| 116 | +``` |
| 117 | + |
| 118 | +Displays the active authentication method, user info, and organization. For OAuth users, shows a list of organizations with the active one highlighted. |
| 119 | + |
| 120 | +```sh |
| 121 | +tigris whoami --json |
| 122 | +``` |
| 123 | + |
| 124 | +Returns machine-readable JSON output including `authMethod`, `email`, `userId`, and organization details. |
| 125 | + |
| 126 | +## Logout |
| 127 | + |
| 128 | +```sh |
| 129 | +tigris logout |
| 130 | +``` |
| 131 | + |
| 132 | +Clears the current login session (OAuth tokens and temporary credentials). Credentials saved via `tigris configure` are preserved. |
| 133 | + |
| 134 | +## Configuration File |
| 135 | + |
| 136 | +Auth state is stored in `~/.tigris/config.json` with restrictive file permissions (600). The file is managed automatically by the CLI — you should not need to edit it directly. |
0 commit comments