oz0 login
For: Operators and developers looking up a command.
Sign in to the CLI as yourself, through one of the cluster's identity providers, with the device flow: the CLI shows a code and a link, you open the link on any device, sign in at the provider (with its own second factor) and enter the code.
The provider's group rules give your roles, as a sign-in to the console does, and the CLI then acts as you on the admin API and the runtime API, through the management port, without a certificate.
The session lasts 7 days: an access token of 15 minutes, which the CLI refreshes by itself, kept in a file beside the CLI context with mode 0600. oz0 logout ends it, and so does a cluster admin on the Sessions page. Commands that need the edge's Temporal port or an operator certificate (job, operator renew, mcp) still need a context from oz0 server operator issue.
The first time, name the management address and the cluster's CA certificate (from your administrator): oz0 login --management https://oz0.example.com:9443 --ca-cert ca.crt --provider okta. Later sign-ins reuse them.
Usage
oz0 login [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--ca-cert | string | the cluster's CA certificate, PEM (once; without one, the system's roots) | |
--management | string | the management port's URL, such as https://oz0.example.com:9443 (once) | |
--provider | string | the identity provider's ID (oz0 login without it lists them) |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.