Skip to content

docs: document v2 login method and OS keyring credential storage #318

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mintlify wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs: document v2 login method and OS keyring credential storage #318

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions standard/cli/command-reference/porter-auth.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,13 @@ porter auth login --token <YOUR_TOKEN>
After logging in, Porter automatically sets your default project and cluster if you have access to any. You can view these with `porter config`.
</Info>

### Credential storage

The location where credentials are persisted depends on the login method configured via [`porter config set-login-method`](/standard/cli/command-reference/porter-config#porter-config-set-login-method):

- **`v1` (default):** A long-lived Porter JWT is written to `porter.yaml`.
- **`v2`:** Access and refresh tokens are stored in your OS credential store (macOS Keychain, Linux Secret Service, or Windows Credential Manager) and refreshed automatically. Switching to `v2` and logging in migrates any existing plaintext tokens out of `porter.yaml`.

---

## `porter auth logout`
Expand Down
38 changes: 38 additions & 0 deletions standard/cli/command-reference/porter-config.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,44 @@ Run `porter cluster list` first to see available clusters and their IDs.

---

## `porter config set-login-method`

Select the authentication flow used by `porter auth login`.

**Usage:**
```bash
porter config set-login-method [v1|v2]
```

**Modes:**

| Mode | Description |
|------|-------------|
| `v1` | Legacy flow that issues a long-lived Porter JWT. The token is stored in `porter.yaml`. |
| `v2` | Refreshable session flow. Tokens are stored in your OS credential store (Keychain on macOS, Secret Service on Linux, Credential Manager on Windows) and are automatically refreshed. |

<CodeGroup>
```bash Switch to v2 (recommended)
porter config set-login-method v2
porter auth login
```

```bash Switch back to v1
porter config set-login-method v1
porter auth login
```
</CodeGroup>

<Info>
When you log in with `v2`, Porter stores your access and refresh tokens in the OS keyring instead of in `porter.yaml`. If you previously logged in with `v1`, switching to `v2` and logging in once migrates any plaintext tokens out of `porter.yaml` automatically.
</Info>

<Tip>
Use `v2` for local development on a single machine. For CI/CD pipelines, continue to use a `PORTER_TOKEN` environment variable — the keyring is intended for interactive sessions.
</Tip>

---

## Configuration File

Porter stores configuration in `~/.porter/config.json`. You can also override settings using environment variables:
Expand Down