Skip to main content

meshStack CLI Login

The meshStack CLI signs you in through your browser and then calls the meshObject API with your own permissions. Unlike an API Key, a CLI login belongs to you personally rather than to a workspace. Install the CLI as described in its GitHub repository.

How the Login Works​

  1. Run the login command:

    meshstack login

    The CLI opens your browser at your meshStack's login page.

  2. Sign in the same way you sign in to meshPanel.

  3. Confirm the consent screen that asks whether the meshStack CLI may act on your behalf.

  4. The browser hands the token to the CLI, which stores it on your machine.

The CLI uses the OAuth 2.0 authorization code flow with PKCE and a loopback redirect, the standard for command line applications (RFC 8252). It is a public client and holds no secret.

If you work with more than one meshStack, give each login its own profile with --profile <profile name>, and point the CLI at the API URL of that meshStack with --endpoint <your meshStack API URL>.

Use Your Login in Other Tools​

meshstack api sends a request to the meshObject API with your login and renews the token for you. Use it in scripts.

To call the API with another tool, print the current access token:

meshstack auth token

The token is short-lived, so get a new one when the old one stops working. It is for the default workspace that meshstack login stored; add --workspace <workspace identifier> for another one. You can paste the token into the Bearer Token field of this documentation's API reference, see Try It in This Documentation.

The meshStack Terraform provider uses a CLI profile when you set profile. It acts in the profile's default workspace unless you set workspace:

provider "meshstack" {
  profile   = "<profile name>"
  workspace = "<workspace identifier>"
}

The profile and workspace settings need provider version 0.26.0 or later and are a preview feature.

What a CLI Login Can Do​

A CLI login calls the meshObject API with exactly the permissions you hold through your workspace roles. meshStack checks those permissions on every request, so the CLI can never do more than you can do in meshPanel yourself. It has no access to the internal API that meshPanel uses.

Lifetime and Revoking a Login​

A CLI login expires 24 hours after you created it. After that you log in again.

You can end a login earlier at any time:

  1. Go to Profile > CLI Logins in meshPanel.
  2. The table lists every CLI login on your account with the time it was first and last used.
  3. Choose Revoke on a single login, or Revoke all to end all of them.

Revoking all logins also withdraws your consent, so the next login asks you to confirm it again. A revoked login stops working within five minutes at the latest.

meshStack writes an event log entry when a CLI login is issued and another when it is revoked. Administrators find these in the Admin Area under Compliance > Event Logs.