API key credential type for Temporal Cloud CLI
API key is a credential type for Temporal Cloud CLI authentication, provided via the --api-key flag. It can be used instead of interactive login for automation and CI/CD pipelines.
authentication
11 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
Three credential types for Temporal Cloud CLI
Temporal Cloud supports three credential types: OAuth tokens obtained through the temporal cloud login command, API keys, and mTLS certificates.
Log out from Temporal Cloud CLI
To log out, run the temporal cloud logout command with the profile flag. This will remove the OAuth token from the specified configuration profile. If you provided API keys or mTLS certificates, they will remain in the profile.
Non-interactive authentication for scripts and CI
For AI agents, CI pipelines, scripts, and other non-interactive environments, use API keys or mTLS certificates. Store credentials in a configuration profile or set them as environment variables to avoid passing them on every command.
Pass API key credentials inline for CLI commands
To pass an API key inline to a CLI command, use the --api-key flag with the format: temporal workflow list --address <namespace>.<account>.tmprl.cloud:7233 --namespace <namespace>.<account> --api-key <your-api-key>
Pass mTLS certificate credentials inline for CLI commands
To pass mTLS certificates inline to a CLI command, use the --tls-cert-path and --tls-key-path flags with the format: temporal workflow list --address <namespace>.<account>.tmprl.cloud:7233 --namespace <namespace>.<account> --tls-cert-path /path/to/client.pem --tls-key-path /path/to/client.key
Interactive login with OAuth tokens
The temporal cloud login command opens a browser to authenticate with Temporal Cloud using OAuth. Provide a profile name to store credentials. If no profile is specified, credentials are stored in the default profile. After login, the OAuth token is stored in the specified configuration profile.
API key authentication for service account commands
The --api-key flag can be used with any service account command instead of interactive login for automation and CI/CD pipelines.
API key authentication for Temporal Cloud CLI
The --api-key flag allows authentication with Temporal Cloud. It can be used instead of interactive login for automation and CI/CD pipelines. This is available as a global flag and on individual commands.
Web UI auth configuration with OIDC
Auth configuration controls who can access the Web UI itself, not authorization against the Temporal Service. Auth is configured via the `auth` field with properties: enabled (boolean), providers array with label (string for internal use), type (protocol like oidc), providerUrl (URL of auth provider), issuerUrl, clientId, clientSecret, callbackUrl (Web UI callback endpoint), and scopes array (e.g., openid, profile, email). Example uses Google OAuth with callbackUrl like https://xxxx.com:8080/auth/sso/callback.
Temporal Cloud CLI credential types
The configuration reference does not document the three credential types for Temporal Cloud CLI.