---
title: "oz0 login"
description: "Usage and flags for oz0 login."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/login"
---
# oz0 login

> Usage and flags for oz0 login.

For: Operators and developers looking up a command.

Sign in to the CLI as yourself, through one of the cluster's identity providers, with the device flow: the CLI shows a code and a link, you open the link on any device, sign in at the provider (with its own second factor) and enter the code.

The provider's group rules give your roles, as a sign-in to the console does, and the CLI then acts as you on the admin API and the runtime API, through the management port, without a certificate.

The session lasts 7 days: an access token of 15 minutes, which the CLI refreshes by itself, kept in a file beside the CLI context with mode 0600. `oz0 logout` ends it, and so does a cluster admin on the Sessions page. Commands that need the edge's Temporal port or an operator certificate (job, operator renew, mcp) still need a context from `oz0 server operator issue`.

The first time, name the management address and the cluster's CA certificate (from your administrator): oz0 login --management `https://oz0.example.com:9443` --ca-cert ca.crt --provider okta. Later sign-ins reuse them.

## Usage

```bash
oz0 login [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --ca-cert
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the cluster's CA certificate, PEM (once; without one, the system's roots)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --management
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the management port's URL, such as <code>
        https://oz0.example.com:9443
      </code>
      
       (once)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --provider
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the identity provider's ID (oz0 login without it lists them)
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.