ibmcloud-login
authenticates to IBM Cloud
TLDR
SYNOPSIS
ibmcloud login [options]
DESCRIPTION
ibmcloud login authenticates the CLI against IBM Cloud and stores the resulting IAM tokens in the configuration directory. It supports interactive prompts, federated single sign-on, API keys, and compute resource identities backed by trusted profiles.Login also sets the initial target. Account, region, and resource group can be selected inline with -c, -r, and -g, or changed later with ibmcloud target. Without -r the CLI prompts for a region; --no-region skips that prompt.Tokens expire and are refreshed automatically while the session is valid. Run ibmcloud logout to discard them.
PARAMETERS
-a APIENDPOINT_
API endpoint, for example `cloud.ibm.com`, or `private.cloud.ibm.com` to log in over a private endpoint.-u USERNAME
User name. Optional; prompted for when omitted.-p PASSWORD
Password. Optional; prompted for when omitted.--sso
Log in with a federated ID. The CLI prints a URL that yields a one-time passcode.--apikey APIKEY|@FILE_
API key content, or the path of a file holding the key prefixed with `@`.--cr-token TOKEN|@FILE
Compute resource token content, or the path of a token file.--vpc-cri
Log in as a VPC virtual server instance compute resource identity.--profile PROFILE
Name, ID, or CRN of the linked trusted IAM profile used to obtain the access token. Requires `--cr-token`, `IBMCLOUDCRTOKEN`, or `--vpc-cri`.-c ACCOUNTID_
ID of the target account. Mutually exclusive with `--no-account`.--no-account
Force login without an account. Not recommended.--accept
Accept an invitation to join the targeted account.-g RESOURCEGROUP_
Name or ID of the target resource group.-r REGION
Name of the target region, for example `us-south` or `eu-gb`.--no-region
Force login without targeting a region.--skip-ssl-validation
Bypass SSL validation of HTTP requests. Not recommended.--vpc
Use a VPC connection for a private API endpoint.
ENVIRONMENT
IBMCLOUD_API_KEY
API key used for non-interactive login. Accepts a key string or `@filename`.IBMCLOUD_CR_TOKEN
Compute resource token used for login, as a string or `@filename`.IBMCLOUD_CR_PROFILE
Name, ID, or CRN of the trusted profile to assume.IBMCLOUD_HOME
Directory holding the session metadata, so that parallel sessions can use separate credentials.
CAVEATS
An API key created for a specific account cannot be used to switch to another account after login.Passing -p on the command line leaves the password in the shell history and in the process list; prefer an API key or the interactive prompt.Federated accounts must use --sso; plain -u/-p login fails for them.
HISTORY
ibmcloud login is part of the IBM Cloud CLI, which replaced the earlier `bluemix` (`bx`) CLI when Bluemix was rebranded to IBM Cloud around 2018.
SEE ALSO
ibmcloud(1), ibmcloud-logout(1), ibmcloud-target(1), ibmcloud-api(1), ibmcloud-iam(1)
