stratumctl auth

Inspect authentication state

stratumctl auth [flags]

Subcommands

• stratumctl auth change-password: Choose a new password for the signed-in account
• stratumctl auth list-profiles: List all profiles in ~/.stratum/config.yaml
• stratumctl auth status: Print the active profile + endpoint + token validity
• stratumctl auth tokens: Manage personal access tokens
• stratumctl auth use-profile: Set the current_profile pointer in ~/.stratum/config.yaml

stratumctl auth change-password

Choose a new password for the signed-in account

stratumctl auth change-password [flags]

Sets a new password for the account the active profile is signed in as. Every other session of the account is signed out; this one stays.

An account that still has its install-time password (the bootstrap admin right after an install) can do nothing else until it does this.

The new password comes from –new-password, STRATUM_NEW_PASSWORD, or a prompt (asked twice) at a terminal. At least 8 characters, and not the current one.

Examples

stratumctl auth change-password
stratumctl auth change-password --new-password "$NEW_PASSWORD"

Flags

Flag	Type	Default	Description
--new-password	string		The new password (prompts if missing)

stratumctl auth list-profiles

List all profiles in ~/.stratum/config.yaml

stratumctl auth list-profiles [flags]

Examples

stratumctl auth list-profiles

stratumctl auth status

Print the active profile + endpoint + token validity

stratumctl auth status [flags]

Examples

stratumctl auth status
stratumctl auth status --profile lab

stratumctl auth tokens

Manage personal access tokens

stratumctl auth tokens [flags]

Subcommands

• stratumctl auth tokens create: Mint a new PAT (plaintext printed ONCE — store it now)
• stratumctl auth tokens get: Describe a single PAT
• stratumctl auth tokens list: List your personal access tokens
• stratumctl auth tokens revoke: Revoke a PAT. Idempotent.

stratumctl auth tokens create

Mint a new PAT (plaintext printed ONCE — store it now)

stratumctl auth tokens create [flags]

Examples

stratumctl auth tokens create --label ci-deploy --ttl 720h
stratumctl auth tokens create --label read-only --scope "compute:*" --scope network:DescribeVPC

Flags

Flag	Type	Default	Description
--label	string		Operator-facing label for the PAT
--scope	stringSlice		Cedar action prefix scopes (repeatable)
--ttl	string		TTL (Go duration, e.g. 24h, 720h). Empty = no expiry.
--user	string		User id (defaults to current principal)

stratumctl auth tokens get

Describe a single PAT

stratumctl auth tokens get <token-id> [flags]

Examples

stratumctl auth tokens get tok-h3k7mq2xvb4n5r

Flags

Flag	Type	Default	Description
--user	string		User id (defaults to current principal)

stratumctl auth tokens list

List your personal access tokens

stratumctl auth tokens list [flags]

Examples

stratumctl auth tokens list
stratumctl auth tokens list --user u-alice --output json

Flags

Flag	Type	Default	Description
--user	string		User id (defaults to current principal)

stratumctl auth tokens revoke

Revoke a PAT. Idempotent.

stratumctl auth tokens revoke <token-id> [flags]

Examples

stratumctl auth tokens revoke tok-h3k7mq2xvb4n5r

Flags

Flag	Type	Default	Description
--user	string		User id (defaults to current principal)

stratumctl auth use-profile

Set the current_profile pointer in ~/.stratum/config.yaml

stratumctl auth use-profile <name> [flags]

Examples

stratumctl auth use-profile lab