--- updatedAt: 2026-10-07T12:24:19.000Z agentTools: siteIndex: https://docs.jfrog.com/llms.txt projectIndex: https://docs.jfrog.com/integrations/llms.txt --- # Authenticate via the JFrog CLI Authenticate JFrog CLI to your JFrog Platform using tokens, credentials, browser login, or OIDC. This procedure explains how to authenticate to the JFrog Platform using the JFrog CLI command-line tool. Authentication is required to securely access JFrog services, including Artifactory, Xray, Distribution, and other components. When working with JFrog Platform, you have multiple authentication options. Each method allows you to secure access to your JFrog service instance and interact with the API effectively. This topic covers the following authentication methods: * [Authenticate with Username and Password](#authenticate-with-username-and-password) * [Authenticate with an Access Token](#authenticate-with-an-access-token) * [Log In via Browser](#log-in-via-browser) * [Exchange an OIDC Token](#exchange-an-oidc-token) * [Authenticate Using Environment Variables](#authenticate-using-environment-variables) ## Authentication Methods Overview | Method | Interactive | CI/CD Friendly | Use Case | | ------------------------------------------------------------------------ | ----------- | -------------- | ------------------------------------------------- | | Access token (`jf c add --access-token`) | No | Yes | Scripts, pipelines, local use | | Username and password (`jf c add --user --password`) | No | Yes | When tokens are not available | | Browser login (`jf login`) | Yes | No | Interactive developer workflows | | OIDC token exchange (`jf eot`) | No | Yes | OIDC-based CI (GitHub Actions, Azure, and others) | | Command flags (`--url`, `--access-token`; values can come from env vars) | No | Yes | One-shot commands without stored config | ## Which Method Should I Use? | Scenario | Recommended Method | | ---------------------------------------------------- | -------------------------------------------------------------------------------------------------- | | Local development, interactive use | Browser login (`jf login`) | | CI/CD pipelines (Jenkins, GitHub Actions, GitLab CI) | Access token via `jf c add --interactive=false`, or a CI setup action that configures the CLI | | OIDC-enabled CI (GitHub Actions, Azure DevOps) | OIDC token exchange (`jf eot`) | | Quick scripting, one-time use | Pass `--url` and `--access-token` on each command (store values in env vars and expand into flags) | | Sharing config across machines | Export/import (`jf config export` + `jf config import`) | *** ## Prerequisites Before proceeding with authentication using JFrog CLI, ensure that you meet the following prerequisites. * **JFrog CLI Installed**: Make sure that you have the JFrog CLI installed on your system. * **JFrog Account**: An active JFrog account with appropriate permissions to access the service. Ensure you have the necessary login credentials (username and password) or an access token. * **Token Validity (if using access tokens)**: If you choose to authenticate with an access token, ensure that it is a valid JFrog access token and has not expired. Review your token's scope and permissions to confirm it grants the required access. *** ## Authentication using CLI When using JFrog CLI, authentication is mandatory for accessing JFrog Platform services. You can authenticate using either a username and password or an access token. The following sections describe both methods in detail. ### Authenticate with Username and Password To authenticate using your JFrog login credentials, you can configure your credentials permanently using the `jf c add` command. Alternatively, you can provide your credentials dynamically for each command. When you pass `--user` and `--password`, the JFrog CLI uses those credentials to create a new access token. It does not save the password value as your access token. If you already have a reference token, pass it with `--access-token`: ```bash jf c add --url= --access-token= --interactive=false ``` Where: * ``: Unique ID for this server configuration. * ``: Base URL of your JFrog Platform. * ``: The reference token or other access token you already have. #### Configure Once Using `jf c add` **To configure authentication with your username and password:** 1. Run the following command: ```bash jf c add ``` 2. Follow the prompts to enter the necessary information: * **Choose a server ID**: Your chosen name for this configuration (for example, `my_server`). * **JFrog Platform URL**: The base URL for your JFrog instance (for example, `https://yourjfroginstance.jfrog.io`) * **JFrog username**: Your username. * **JFrog password**: Your password. #### Using Command Options For each command, you can specify the following options: | Command Option | Description | | -------------- | ---------------------------------------------------------------------- | | `--url` | JFrog Platform URL (example: `https://yourjfroginstance.jfrog.io`). | | `--user` | Your JFrog username. | | `--password` | Your password or API key. For a reference token, use `--access-token`. | Example command (Artifactory ping): ```bash jf rt ping --url "https://yourjfroginstance.jfrog.io/artifactory" --user "your_username" --password "your_password" ``` Example command (config add with credentials): ```bash jf c add my_server --url "https://yourjfroginstance.jfrog.io" --user "your_username" --password "your_password" ``` *** ### Authenticate with an Access Token To authenticate using a JFrog Access Token, similar to username/password authentication, you can configure your access token using the `jf c add` command, or you can include it directly with each command. #### Configure Once Using `jf c add` **To configure authentication with an access token:** 1. Run the following command: ```bash jf c add ``` 2. When prompted, select **Access token** and enter the token. Use this same choice for a reference token. #### Using Command Options You can specify the following options for authentication: | Command Option | Description | | ---------------- | ------------------------------------------------------------------- | | `--url` | JFrog Platform URL (example: `https://yourjfroginstance.jfrog.io`). | | `--access-token` | Your JFrog access token. | Example command (Artifactory ping): ```bash jf rt ping --url "https://yourjfroginstance.jfrog.io/artifactory" --access-token "your_access_token" ``` Example command (config add with access token): ```bash jf c add my_server --url "https://yourjfroginstance.jfrog.io" --access-token "your_access_token" ``` ## Additional Configuration Options The `jf c add` command supports additional flags for advanced configuration: | Command Option | Description | | ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | | `--url` | JFrog Platform URL (example: `https://yourjfroginstance.jfrog.io`). | | `--artifactory-url` | JFrog Artifactory URL (example: `https://yourjfroginstance.jfrog.io/artifactory`). | | `--xray-url` | JFrog Xray URL (example: `https://yourjfroginstance.jfrog.io/xray`). | | `--distribution-url` | JFrog Distribution URL (example: `https://yourjfroginstance.jfrog.io/distribution`). | | `--user` | JFrog Platform username. | | `--password` | Password or API key. For a reference token, use `--access-token`. | | `--access-token` | Access token. Use this flag for a reference token. | | `--ssh-key-path` | SSH key file path. | | `--client-cert-path` | Client certificate file in PEM format. | | `--client-cert-key-path` | Private key file for the client certificate in PEM format. | | `--enc-password` | \[Default: true] Encrypt the password during the config process. | | `--insecure-tls` | \[Default: false] Set to true to skip TLS certificate verification. | | `--basic-auth-only` | \[Default: false] Use username/password (or API key) directly instead of an auto-refreshed access token. Not compatible with `--access-token`. | | `--password-stdin` | \[Default: false] Set to true to provide the password via stdin. | | `--access-token-stdin` | \[Default: false] Set to true to provide the access token via stdin. | | `--disable-token-refresh` | \[Default: false] Set to true to disable automatic refresh of access tokens. | | `--overwrite` | Overwrite an existing server configuration with the same ID. | | `--interactive` | \[Default: true] Set to false to disable interactive prompts. | **Example with service-specific URLs:** ```bash jf c add my_server \ --url "https://yourjfroginstance.jfrog.io" \ --artifactory-url "https://yourjfroginstance.jfrog.io/artifactory" \ --xray-url "https://yourjfroginstance.jfrog.io/xray" \ --user "your_username" \ --password "your_password" ``` *** ## Using a Configured Server Once you have configured a server using `jf c add`, you can reference it in subsequent commands using the `--server-id` flag: ```bash jf rt ping --server-id my_server ``` To set a configured server as the default, use: ```bash jf c use my_server ``` To view your configured servers: ```bash jf c show ``` *** ### Security Best Practices * **Security**: Ensure that your credentials and access tokens are kept secure and not hardcoded in scripts wherever possible. Consider using environment variables or secure vaults for sensitive information. Use `--password-stdin` or `--access-token-stdin` to avoid passing credentials directly on the command line. * **Token Expiration**: Access tokens may have an expiration time. Be aware of this and renew your token as needed to maintain access. * **Token Refresh**: By default, JFrog CLI automatically refreshes access tokens. Use `--disable-token-refresh` if you want to disable this behavior.
*** ## Log In via Browser Use the `jf login` command to authenticate with the JFrog Platform through a web browser. This opens a browser window for SSO/SAML sign-in. Available for Artifactory 7.64.0 or later. **To authenticate using browser login:** * Run the following command: ```bash jf login ``` **Note** This command is interactive only. You cannot use it on CI servers or in headless environments. For non-interactive authentication, use access tokens or OIDC token exchange. *** ## Exchange an OIDC Token Exchange an OIDC provider token for a JFrog access token. This is the recommended method for OIDC-enabled CI systems like GitHub Actions and Azure DevOps. **To exchange an OIDC token for a JFrog access token:** * Run the following command: ```bash jf eot --oidc-token-id= --url= ``` Where: * ``: The name of the OIDC provider configured in the JFrog Platform (required first argument). * ``: The OIDC token (or token ID) value from your CI job to exchange, passed as a flag or as the second positional argument. * ``: The URL of your JFrog Platform instance (for example, `https://yourcompany.jfrog.io`). Supported provider types: `GitHub`, `Azure`, `GenericOidc`. Use `--oidc-provider-type` to specify. Pass `--oidc-audience` when required by your provider. ### Complete GitHub Actions OIDC Example ```yaml # .github/workflows/build.yml name: Build with JFrog CLI (OIDC) on: [push] permissions: id-token: write # Required for OIDC contents: read jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: jfrog/setup-jfrog-cli@v4 env: JF_URL: ${{ vars.JF_URL }} with: oidc-provider-name: github-oidc # Must match JFrog Platform OIDC config - run: jf rt ping # Verify authentication works - run: jf npm ci --build-name=my-app --build-number=${{ github.run_number }} ``` This eliminates the need to store long-lived access tokens as GitHub secrets. The `setup-jfrog-cli` action handles the OIDC token exchange automatically. *** ## Authenticate Using Environment Variables Store the Platform URL and credentials in environment variables for scripts and CI pipelines. The JFrog CLI does **not** read those variables automatically. Setting them in the shell or with `docker run -e` does not configure a server. Pass the values into `jf config add` or into command flags. The examples below use `JFROG_URL` and `JFROG_ACCESS_TOKEN`. You can use other names. `JF_URL` and `JF_ACCESS_TOKEN` are the names used by [setup-jfrog-cli](https://github.com/jfrog/setup-jfrog-cli) and the GitLab CI JFrog setup templates. Those tools read the variables and run `jf config add` for you. The CLI binary and the CLI Docker image do not. **To authenticate using environment variables:** 1. Set the environment variables: ```bash export JFROG_URL= export JFROG_ACCESS_TOKEN= ``` Where: * ``: The URL of your JFrog Platform instance (for example, `https://yourcompany.jfrog.io`). * ``: A valid JFrog access token. 2. Pass the values to the CLI using one of the following patterns: * **Persist configuration, then use `--server-id`:** ```bash jf config add my-server \ --url="$JFROG_URL" \ --access-token="$JFROG_ACCESS_TOKEN" \ --interactive=false jf rt ping --server-id=my-server ``` * **One-shot command (no stored configuration):** ```bash jf rt ping --url="$JFROG_URL/artifactory" --access-token="$JFROG_ACCESS_TOKEN" ``` For a password or an API key, use the same pattern with `--user` and `--password` instead of `--access-token`. If the secret is a reference token, keep it in the access-token variable. `setup-jfrog-cli` reads `JF_ACCESS_TOKEN`. It does not treat `JF_PASSWORD` as an access token. Expanding an access token into `--access-token` puts it on the process command line. In CI and other shared environments, pipe the token instead: ```bash printf '%s' "$JFROG_ACCESS_TOKEN" | jf config add my-server \ --url="$JFROG_URL" \ --access-token-stdin \ --interactive=false ``` The published CLI Docker images (`jfrog-cli-v2-jf` and `jfrog-cli-full-v2-jf`) run the same `jf` binary and set `CI=true`. Authentication is unchanged: export the variables into the container, then run `jf config add` or pass flags. For image names, see [Install JFrog CLI](/integrations/docs/download-and-install-the-jfrog-cli#docker). **Note** These variables are not listed by `jf options`. That command shows only the `JFROG_CLI_*` environment variables the CLI registers internally (for example, `JFROG_CLI_SERVER_ID` and `JFROG_CLI_LOG_LEVEL`). For the full list, see [JFrog CLI Environment Variables](/integrations/docs/jfrog-cli-environment-variables). *** ## Troubleshooting Authentication | Problem | Cause | Fix | | -------------------------------------------------------------------------- | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | | "no JFrog Platform URL specified" / similar | No `--url` and no server configured | Run `jf config add` or pass `--url` | | "no JFrog Artifactory URL specified" after setting `JFROG_URL` or `JF_URL` | CLI does not auto-read Platform URL or credential environment variables | Pass `--url` and `--access-token` (or `--access-token-stdin`), or run `jf config add` with those values | | "Server ID 'X' doesn't exist" | Typo or wrong server ID | Run `jf config show` to list servers | | Token expired | Access token past its expiry | Create a new token with `jf atc` or regenerate in the UI | | 401 Unauthorized on `jf rt ping` | Wrong credentials or insufficient permissions | Verify token/password. Check user permissions in Artifactory | | 403 Forbidden | Token is valid but lacks permissions | Check user permissions. Admin actions require admin-scoped tokens | | Browser login fails silently | Artifactory version below 7.64.0 | Upgrade Artifactory or use token-based authentication instead | | OIDC exchange returns empty token | OIDC provider misconfigured | Verify the provider name (first `jf eot` argument) matches your JFrog Platform OIDC integration under **Administration > Security > OIDC** | Set `JFROG_CLI_LOG_LEVEL=DEBUG` to get detailed output for diagnosing authentication issues: ```bash JFROG_CLI_LOG_LEVEL=DEBUG jf rt ping ``` *** **Note** If you have been managing artifacts through the Artifactory web interface, the CLI uses the same access tokens. Generate a token in the UI at **Administration** > **Identity and Access** > **Access Tokens**, then pass it to `jf config add --access-token=`. Your repository names, permissions, and project keys are the same in both the UI and the CLI. **Note** If you have been using `curl` with JFrog REST API endpoints, the CLI handles authentication headers, token refresh, and retries automatically. Replace `curl -H "Authorization: Bearer " https://your-server/api/...` with `jf config add` followed by CLI commands. The CLI maps to the same underlying REST API. For example, `curl -X POST .../api/security/token` becomes `jf access-token-create`. ## Frequently Asked Questions This section provides answers to frequently asked questions. ##### Q: How do I authenticate JFrog CLI with an access token? **A:** Run `jf c add` and enter your access token when prompted, or pass `--access-token` with each command. See [Authenticate with an Access Token](#authenticate-with-an-access-token) for the full syntax. ##### Q: What happens if I don't set a JFrog Platform URL before running a command? **A:** JFrog CLI returns a "no JFrog Platform URL specified" error. Run `jf config add` or pass `--url` on the command, as described in [Troubleshooting Authentication](#troubleshooting-authentication). ##### Q: What is the difference between browser login and access token authentication? **A:** Browser login (`jf login`) is interactive and requires a browser for SSO or SAML sign-in, so it doesn't work in CI/CD pipelines. Access tokens work non-interactively and are the recommended method for scripts and pipelines. See [Which Method Should I Use?](#which-method-should-i-use) for more scenarios. ##### Q: What do I need before authenticating with JFrog CLI? **A:** You need JFrog CLI installed, an active JFrog account with valid login credentials or an access token, and confirmation that any access token you use hasn't expired. See [Prerequisites](#prerequisites) for details. ##### Q: Can I use OIDC token exchange for CI/CD pipelines? **A:** Yes. Run `jf eot` to exchange a token from an OIDC-enabled provider like GitHub Actions or Azure DevOps for a JFrog access token, without storing long-lived secrets. See [Exchange an OIDC Token](#exchange-an-oidc-token) for the full command. ##### Q: Does JFrog CLI automatically use JF_URL and JF_ACCESS_TOKEN? **A:** No. The CLI binary and the CLI Docker image do not read those variables as credentials. Pass them into `jf config add` or command flags, or use `--access-token-stdin`. GitHub Action `jfrog/setup-jfrog-cli` and GitLab CI JFrog setup templates do read `JF_URL` and `JF_ACCESS_TOKEN` and then configure the CLI. See [Authenticate Using Environment Variables](#authenticate-using-environment-variables). ## Related Topics * [Add a JFrog CLI Server Configuration](/integrations/docs/jf-config-add) * [Exchange an OIDC Token](/integrations/docs/jf-exchange-oidc-token) * [Log In to the JFrog Platform with JFrog CLI](/integrations/docs/jf-login) * [JFrog CLI Quick Start](/integrations/docs/jfrog-cli-quick-start) * [JFrog CLI Environment Variables](/integrations/docs/jfrog-cli-environment-variables) * [Install JFrog CLI](/integrations/docs/download-and-install-the-jfrog-cli)