Skip to main content
Version: v5.6.1

opschain admin login

Included from Basic tier

Stores a server's admin bearer token in the CLI token store — keychain-backed, beside the user login tokens, keyed per server — so the admin verbs that take the admin bearer need neither a flag nor an exported variable afterwards.

This command serves local-lane servers only (compositions without the full auth stack — the embedded SQLite store, dev harnesses — where the static admin token is the only admin guard). On a full-auth server the admin verbs ride your own opschain login session with RBAC, the static admin token is refused with a typed answer, and identity-outage recovery is a break-glass local user login — so when the target answers the stored token with that typed refusal, the command still stores the token but prints the retirement notice on stderr.

The fleet admin verbs (admin server, admin platform, admin database, admin runner, admin runner-group, …) resolve their credential in this order: --auth-token, then your stored opschain login session, then OPSCHAIN_ADMIN_TOKEN, then the token stored here for the target server.

The server resolves exactly like every other command: --server <url>, OPSCHAIN_SERVER, or the active opschain context. The token is stored against that exact server URL, so a later command must target the same URL to find it.

Flags​

FlagMeaning
--server <url>Server base URL to store the token for (default: the active context / OPSCHAIN_SERVER).
--auth-token <token>The admin bearer token to store (default: $OPSCHAIN_ADMIN_TOKEN).

The global --no-keychain matters here: with it, the token store falls back from the OS keychain to the key-file-backed store. -q, --quiet suppresses the confirmation line and the retirement notice.

Exit codes​

CodeMeaning
0Token stored (the full-auth retirement notice does not change the exit code).
1The token store could not be opened or written.
2Usage error — no server or no token resolvable.

Named errors and notices​

  • a server is required — pass --server <url>, set OPSCHAIN_SERVER, or 'opschain context use <name>' — no server anywhere (exit 2).
  • an admin token is required (--auth-token or OPSCHAIN_ADMIN_TOKEN) — no token anywhere (exit 2).
  • note: this server runs the full auth stack, so it refuses the static admin token … — printed on stderr when the target answers the stored token with the typed ERROR_REASON_ADMIN_TOKEN_RETIRED refusal; the token is stored regardless.

Examples​

opschain admin login --server http://localhost:7726 --auth-token <token>
admin token stored for http://localhost:7726

With an active context and the token in the environment:

OPSCHAIN_ADMIN_TOKEN=<token> opschain admin login

See also​

  • opschain docs cli/admin-logout — remove the stored token.
  • opschain docs cli/login — the credential every admin verb prefers on a full-auth server.