Skip to main content
Every API request is made as you, a person signed in with your Andromeda account. You sign in with the andromeda CLI, which then attaches your token to every request, or you send a token from your own OpenID Connect client. There are no API keys. Service accounts are refused by the endpoints in these docs: Business returns 401 and Platform returns 403. SSH logins, permissions, and cluster usernames all belong to people.

​
Install the CLI

The CLI runs on macOS and Linux, on amd64 and arm64. Ask your Andromeda contact for the binary for your platform, put it on your PATH, and check it runs:
The examples in these docs also use jq to read fields out of JSON responses.

​
Sign in

The CLI prints a URL and a code:
Open the URL in a browser, sign in with the account you use for Console, and enter the code. The CLI waits for you to finish, then prints Authenticated to https://platform-v2.andromedacluster.xyz. The CLI stores your session in the operating system’s credential store (Keychain on macOS, the Secret Service on Linux). It never prints the token. Check the session at any time:
The expiry is the current access token’s. Access tokens are short-lived, and the CLI refreshes them before each request that needs one, so access token expired; refresh required does not mean you must sign in again. When the session itself can no longer be refreshed, run andromeda auth login again. To remove the stored session:

​
Use more than one environment

The CLI signs in to production unless you tell it otherwise. If Andromeda has given you a second environment, sign in to it under its own profile. Pass its Platform URL, which Andromeda gives you with the environment, once at login:
The profile remembers the environment, so later commands only need --profile:
Without --profile, commands use the profile named default. --url or the ANDROMEDA_URL environment variable points a single command at another environment without changing the profile.

​
Call the API from your own client

If you already sign people in through your own OpenID Connect client, you can call the APIs directly. Send the access token in the Authorization header:
A request without a valid token returns 401 with WWW-Authenticate: Bearer. Each environment describes how to get an acceptable token. Its Platform API publishes that description at /.well-known/oauth-protected-resource, in the RFC 9728 format. The endpoint needs no authentication:
The token must be issued by the listed issuer to a person, and must carry every audience in andromeda_audiences. The CLI gets one by requesting the scopes openid profile email offline_access plus urn:zitadel:iam:org:project:id:<audience>:aud for each audience.

​
Next