Authentication
Sign in, where the token is kept, and how a command works out which team it acts on.
A credential belongs to one team. Signing in stores one; a pipeline supplies one through the environment instead.
Signing In
outplane loginThis opens the console and waits. Approving there hands the token to a listener on this machine, so the token is never displayed, copied or pasted, and never reaches a terminal's history.
Where there is no browser, over SSH or inside a container, the same command prints the
address and reads a token you paste. Nothing about that is an error, and --no-browser
asks for it directly.
outplane login --no-browser
outplane login --token-stdin < token.txt--token accepts the token as an argument, and is the one form worth avoiding. Command
arguments are visible in process lists and in most pipeline logs. Prefer
--token-stdin, or OUTPLANE_TOKEN.
A token belongs to a single team, so signing in a second time adds a credential rather
than replacing the first. outplane team list shows them, and outplane team use
picks which one is the default.
Where the Token Is Kept
In the operating system's keychain when there is one. Where there is not, which is every container and most headless servers, it goes into a file that only its owner can read.
outplane status says which of the two answered:
outplane status --json --fields tokenSource,teamSlug,expiredSigning out removes the local copy only. A token that has leaked has to be revoked in the console; deleting your copy does nothing to it.
outplane logout # this team
outplane logout --all # every team on this machineIn a Pipeline, Do Not Sign In
Set OUTPLANE_TOKEN. It outranks everything stored, and the token names its own team,
so nothing else has to be configured.
OUTPLANE_TOKEN=$OUTPLANE_TOKEN outplane deploy create --waitCreate the token under API Tokens in the console. It is shown once, at creation.
Which Team a Command Acts On
The first of these that is set wins. outplane status reports the winner in
teamSource, which is the fastest way to answer "why is it doing that".
| Order | Source | Notes |
|---|---|---|
| 1 | --token | The token's own team, for one command. |
| 2 | OUTPLANE_TOKEN | The token's own team. What a pipeline uses. |
| 3 | --team | A slug or id, for one command. |
| 4 | OUTPLANE_TEAM_ID | For a shell session. |
| 5 | The directory link | Written by outplane link, and read from this directory or a parent. |
| 6 | outplane team use | This machine's default. |
Which Application
Most commands take the application as their first argument. When it is left out:
| Order | Source |
|---|---|
| 1 | The positional argument, or --app where the group uses a flag |
| 2 | OUTPLANE_APP_ID |
| 3 | The application in the directory link |
A name is matched exactly, against the id first, then the name, then the display name. There is no fuzzy matching, and a display name shared by two applications is an error rather than a guess.
Environment Variables
| Variable | What It Does |
|---|---|
OUTPLANE_TOKEN | The credential to use. Outranks everything stored. |
OUTPLANE_TEAM_ID | The team to act on, when the token does not decide it. |
OUTPLANE_APP_ID | The application to act on when none is named. |
OUTPLANE_HOME | Where configuration is kept, instead of the default directory. |