Skip to main content

meshStack CLI Login

The meshStack CLI signs you in through your browser and then calls the meshObject API with your own permissions. Unlike an API Key, a CLI login belongs to you personally rather than to a workspace.

How the Login Works​

  1. Run the login command:

    meshstack auth login

    The CLI opens your browser at your meshStack's login page.

  2. Sign in the same way you sign in to meshPanel.

  3. Confirm the consent screen that asks whether the meshStack CLI may act on your behalf.

  4. The browser hands the token to the CLI, which stores it on your machine.

The CLI uses the OAuth 2.0 authorization code flow with PKCE and a loopback redirect, the standard for command line applications (RFC 8252). It is a public client and holds no secret.

What a CLI Login Can Do​

A CLI login calls the meshObject API with exactly the permissions you hold through your workspace roles. meshStack checks those permissions on every request, so the CLI can never do more than you can do in meshPanel yourself. It has no access to the internal API that meshPanel uses.

Lifetime and Revoking a Login​

A CLI login expires 24 hours after you created it. After that you log in again.

You can end a login earlier at any time:

  1. Go to Profile > CLI Logins in meshPanel.
  2. The table lists every CLI login on your account with the time it was first and last used.
  3. Choose Revoke on a single login, or Revoke all to end all of them.

Revoking all logins also withdraws your consent, so the next login asks you to confirm it again. A revoked login stops working within five minutes at the latest.

meshStack writes an event log entry when a CLI login is issued and another when it is revoked. Administrators find these in the Admin Area under Compliance > Event Logs.