Authentication and profiles

Best for interactive use, when you move between organizations:

zenifra auth login
zenifra orgs
zenifra org set
zenifra whoami

zenifra whoami shows the active profile, the API, and the selected organization, without exposing credentials.

Opens the Console so you can sign in, complete the security check, and approve CLI access:

zenifra auth login --oauth
zenifra auth login --oauth --read-only
zenifra auth login --oauth --no-browser

--read-only requests read-only access; your organization permissions still apply.
--no-browser prints the address so you can open it manually in a browser on the same machine.
--read-only and --no-browser require --oauth.
The login waits up to three minutes; press Ctrl+C to cancel. Tokens are kept in the private local profile and renewed automatically.

Without --oauth, auth login uses email, password, and verification.

API key for automation

Use an organization API key in scripts, runners, and pipelines:

export ZENIFRA_API_KEY=znf_your_key
zenifra projects --type http --page 1 --limit 15
zenifra deploy --project <project-id> --branch main

Or save the key in the active profile:

zenifra auth api-key --key znf_your_key

API keys already carry their linked organization, so projects, deploy, builds, and deployments do not require org set. Personal commands such as orgs and org set require zenifra auth login.

Sign out and revoke

zenifra auth logout            # removes local authentication only
zenifra auth logout --revoke   # also revokes the profile's connection

--revoke requires a profile authenticated by login and does not revoke API keys.

Profiles and environments

Local profiles separate credentials, description, and API base:

zenifra profile list
zenifra profile add --name prod --description Production --api-base https://api.zenifra.com/v1 --mode api-key --key znf_your_key
zenifra profile use prod
zenifra profile show
zenifra profile edit prod --description "Main production"
zenifra profile remove prod

auth login --profile <name> and auth api-key --profile <name> create or update another profile and make it active. Do not reuse a token against another API: create another profile.

Environment variables override the profile only for the current run:

ZENIFRA_API_URL=https://api.zenifra.com/v1 zenifra projects --type http
ZENIFRA_CONFIG_DIR=/tmp/zenifra-cli zenifra profile list

ZENIFRA_API_KEY takes precedence over the profile credential. Use ZENIFRA_CONFIG_DIR in tests to avoid changing your real session.

Organizations

zenifra orgs
zenifra org set
zenifra org set --org <organization-id>

Security

Store ZENIFRA_API_KEY in your CI provider's secrets.
Prefer an environment variable on ephemeral runners, without saving a local session.
Configure an IP allowlist when the automation has a fixed origin.
Grant only the permissions the job needs.
Rotate and revoke old keys.
Avoid printing full values of sensitive variables in CI logs.

Authentication and profilesCopy Anchor Link