Authentication

Catalog OAuth (browser)

When ZECTRE_CATALOG_URL (or catalog_url in config) points at a running zectre-catalog, zectre login drives a browser OAuth flow (e.g. GitHub) and stores a Bearer token for the cluster API.

Ensure the cluster trusts the catalog’s JWKS and that issuer/audience match — see Auth & catalog.

Legacy platform login

Skip the catalog:

zectre login --legacy-platform-login

Uses the older API-key / polling style flow against the cluster API only.

API key (non-interactive)

zectre login --with-key <key>

ZECTRE_API_KEY can also force API-key auth for requests.

JWT audience

If your catalog issues tokens with a specific audience, set ZECTRE_JWT_AUDIENCE so the exchange matches what the API expects.

Log out

zectre logout

Who am I?

zectre whoami