Access & tokens

This page covers authenticating the CLI, minting tokens for CI and nodes, verifying the audit log, and exporting your tenant’s identity root.

Profiles

brig login opens your browser to authorize the CLI and writes the token to ~/.brig/config.json. For more than one workspace, use named profiles:

brig login --profile staging        # authorize and store under "staging"
brig --profile staging ps           # use it for one command
brig use staging                    # make it the active profile

Command	What it does
brig login	Store credentials. --token for non-interactive; --no-browser to paste a token on stdin (headless/SSH); --cp-url to point at a specific control plane.
brig logout	Remove the stored token for the active (or --profile) profile.
brig whoami	Show the active profile, cp URL, whether a token is configured, and where each value came from.
brig use <profile>	Switch the active profile.
brig profiles	List configured profiles (* marks active).
brig profiles rm <profile>	Remove a profile.

Configuration precedence

The CLI resolves each value in this order:

1. BRIG_PROFILE — selects a named profile from the config file.
2. BRIG_CP_URL / BRIG_API_TOKEN — per-call overrides (the escape hatch for CI; not needed in normal use).
3. The active profile in ~/.brig/config.json (written by brig login).

You don’t type a control-plane URL in normal use — the binary knows where to dial.

API tokens

For CI, scripts, and the proxy, mint tokens with brig token:

brig token create api --label "ci-deploy" --ttl 86400 --scope deploy
brig token list api
brig token revoke api tok_abc123

<kind> is one of:

• api — a bearer token for the API. Pass --scope (repeatable) to limit it; omit for a legacy admin-scoped token. Use it from CI via BRIG_API_TOKEN.
• node-join — a one-shot token that authorizes a server to join the fleet. brig node add / brig node provision mint these for you, so you rarely call this directly.
• proxy — an API token pre-scoped for the mesh proxy (proxy:cert, proxy:endpoints).

The token value is shown once at creation — copy it then; it can’t be retrieved later. --ttl is in seconds; 0 means no expiry.

List and revoke use the kind too: brig token list node, brig token revoke node <id>.

Caution

A token is a credential. Prefer short --ttl values and the narrowest --scope that works, and revoke tokens you no longer need.

Audit log

Every privileged action is appended to a tamper-evident, hash-chained audit log. Verify the chain for your workspace:

brig audit verify

audit chain intact (1284 events verified)

If any event was altered or removed, the command reports AUDIT CHAIN TAMPERED with the offending event id and the expected vs. actual hash, and exits non-zero.

Tenant CA

Each workspace has its own root certificate authority backing the workload-identity mesh. Export it as PEM — useful for pinning, or for an external client that needs to verify mesh certificates:

brig tenant ca > tenant-ca.pem

See Networking for how the mesh uses these identities.