authentication/methods

13 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Three credential types for Temporal Cloud CLI

Temporal Cloud supports three credential types for CLI authentication: OAuth tokens obtained through the `temporal cloud login` command (requires the Temporal Cloud extension), API keys, and mTLS certificates.

Interactive login with temporal cloud login

The `temporal cloud login` command opens a browser to authenticate with Temporal Cloud using OAuth. Provide a profile name to store credentials; if no profile is specified, credentials are stored in the `default` profile. Example: `temporal cloud login --profile prod`. After login, the OAuth token is stored in the specified configuration profile.

Confirm Temporal Cloud login with whoami command

To confirm your login to Temporal Cloud, run the `temporal cloud whoami` command.

Running CLI commands against Temporal Cloud with profile

Run commands against Temporal Cloud by specifying the profile, address, and Namespace. Example: `temporal workflow list --profile prod --address <address> --namespace <namespace>`.

Non-interactive authentication for Temporal Cloud

For AI agents, CI pipelines, scripts, and other non-interactive environments, use API keys or mTLS certificates. Store credentials in a configuration profile or set them as environment variables to avoid passing them on every command.

Passing API key inline to Temporal Cloud CLI

To pass an API key inline to the Temporal CLI: `temporal workflow list --address <namespace>.<account>.tmprl.cloud:7233 --namespace <namespace>.<account> --api-key <your-api-key>`.

Logout from Temporal Cloud with temporal cloud logout

To log out, run the `temporal cloud logout` command with an optional profile name: `temporal cloud logout --profile prod`. This removes the OAuth token from the specified configuration profile. If you provided API keys or mTLS certificates, they will remain in the profile.

API keys authenticate Temporal Cloud API requests

API keys are used to authenticate requests to the Temporal Cloud API.

Claim Mapper

The Claim Mapper component is a pluggable component that extracts Claims from JSON Web Tokens (JWTs).

Connection configuration via temporalio.envconfig

The connect_temporal_client() function delegates to temporalio.envconfig which reads connection settings from a TOML profile at ~/.config/temporalio/temporal.toml (or the path in TEMPORAL_CONFIG_FILE) and applies environment variable overrides: TEMPORAL_ADDRESS, TEMPORAL_NAMESPACE, TEMPORAL_API_KEY, and the TEMPORAL_TLS_* family. This is the same configuration source the Temporal CLI uses. API-key authentication enables TLS automatically; for self-hosted TLS without an API key, set TEMPORAL_TLS_* variables; for temporal server start-dev, leave variables unset to fall back to plain TCP.

TEMPORAL_API_KEY environment variable

TEMPORAL_API_KEY provides an API key for authentication. When set, TLS is enabled by default. TOML key: profile.<name>.api_key. CLI flag: --api-key. Read by: every client.

auth configuration for Web UI

The auth configuration section enables authorization for the Temporal Server. It includes the following fields: enabled (boolean), providers with nested fields including label (string, for internal use), type (protocol type, e.g., 'oidc'), providerUrl (URL of the authorization provider), issuerUrl (issuer URL), clientId (application client ID), clientSecret (application secret), callbackUrl (callback URL after authentication), and scopes (array of requested scopes such as 'openid', 'profile', 'email').

Temporal Cloud authentication methods for Workers

Temporal Cloud supports two secure authentication methods for Workers: mTLS Certificates and API Keys. API Keys are configured via the UI when creating a namespace.

Give your agent this brain