Skip to main content
Manage managed auth connections, stored credentials, and external credential providers from the CLI. For authenticating the CLI itself (login, logout, API keys), see Authentication.

​
Connections

A managed auth connection keeps a profile logged into a domain so future browsers reuse the authenticated session. See Managed auth for concepts and the programmatic flow for the SDK equivalent.

​
kernel auth connections create

Create a managed auth connection for a profile and domain.
FlagDescription
--profile-name <name>Name of the profile to manage (required).
--domain <domain>Target domain for authentication (required).
--allowed-domain <domain>Additional allowed domains (repeatable).
--login-url <url>Login page URL to skip discovery.
--health-check-interval <seconds>Seconds between health checks (300–86400).
--proxy-id <id>Proxy ID to use.
--proxy-name <name>Proxy name to use.
--credential-provider <name>External credential provider name.
--credential-name <name>Kernel credential name to use.
--credential-path <path>Provider-specific path (e.g. VaultName/ItemName).
--credential-autoLook up the credential by domain from the provider (defaults to true when --credential-provider is set without --credential-path).
--no-save-credentialsDon’t save credentials after a successful login.
--output json, -o jsonOutput raw JSON object.

​
kernel auth connections list

List managed auth connections.
FlagDescription
--domain <domain>Filter by domain.
--profile-name <name>Filter by profile name.
--limit <n>Maximum number of results to return.
--offset <n>Number of results to skip.
--output json, -o jsonOutput raw JSON array.

​
kernel auth connections get <id>

Get a managed auth connection by ID.
FlagDescription
--output json, -o jsonOutput raw JSON object.

​
kernel auth connections login <id>

Start a login flow and return a hosted URL for authentication.
FlagDescription
--proxy-id <id>Proxy ID to use for this login.
--proxy-name <name>Proxy name to use for this login.
--output json, -o jsonOutput raw JSON object.

​
kernel auth connections submit <id>

Submit field values to an in-progress login flow. Poll the connection (or use follow) to track progress.
FlagDescription
--field <name=value>Field name/value pair (repeatable).
--mfa-option-id <id>MFA option ID when an MFA method was selected.
--sign-in-option-id <id>Sign-in option ID when the flow returned non-MFA choices.
--sso-button-selector <xpath>XPath selector when choosing an SSO button.
--sso-provider <provider>SSO provider when choosing by provider (e.g. google, github).
--output json, -o jsonOutput raw JSON object.
# Submit username and password
kernel auth connections submit <id> --field username=myuser --field password=mypass

# Select an MFA option
kernel auth connections submit <id> --mfa-option-id <id>

​
kernel auth connections follow <id>

Stream real-time login flow state updates over SSE.
FlagDescription
--output json, -o jsonOutput raw JSON events.

​
kernel auth connections update <id>

Update connection settings such as login URL, health checks, credential source, and proxy.
FlagDescription
--login-url <url>Login page URL (set to an empty string to clear).
--allowed-domain <domain>Additional allowed domains (replaces the existing list).
--health-check-interval <seconds>Seconds between health checks.
--proxy-id <id>Proxy ID to use.
--proxy-name <name>Proxy name to use.
--credential-provider <name>External credential provider name.
--credential-name <name>Kernel credential name to use.
--credential-path <path>Provider-specific path (e.g. VaultName/ItemName).
--credential-autoLook up the credential by domain from the provider.
--save-credentialsSave credentials after a successful login.
--no-save-credentialsDon’t save credentials after a successful login.
--output json, -o jsonOutput raw JSON object.

​
kernel auth connections delete <id>

Delete a managed auth connection.
FlagDescription
--yes, -ySkip the confirmation prompt.

​
Credentials

Store login field values, TOTP secrets, and SSO settings that managed auth connections use to authenticate. See Credentials for concepts.

​
kernel credentials create

Create a new credential.
FlagDescription
--name <name>Unique name for the credential (required).
--domain <domain>Target domain this credential is for (required).
--value <name=value>Field name/value pair (repeatable, e.g. --value username=myuser --value password=mypass).
--totp-secret <secret>Base32-encoded TOTP secret for 2FA.
--sso-provider <provider>SSO provider (e.g. google, github, microsoft).
--output json, -o jsonOutput raw JSON object.

​
kernel credentials list

List credentials.
FlagDescription
--domain <domain>Filter by domain.
--limit <n>Maximum number of results to return.
--offset <n>Number of results to skip.
--output json, -o jsonOutput raw JSON array.

​
kernel credentials get <id-or-name>

Get a credential by ID or name.
FlagDescription
--output json, -o jsonOutput raw JSON object.

​
kernel credentials update <id-or-name>

Update a credential.
FlagDescription
--name <name>New name for the credential.
--value <name=value>Field name/value pair to update (repeatable).
--totp-secret <secret>Base32-encoded TOTP secret (set to an empty string to remove).
--sso-provider <provider>SSO provider (set to an empty string to remove).
--output json, -o jsonOutput raw JSON object.

​
kernel credentials totp-code <id-or-name>

Print the current TOTP code for a credential.
FlagDescription
--output json, -o jsonOutput raw JSON object.

​
kernel credentials delete <id-or-name>

Delete a credential by ID or name.

​
Credential providers

Connect an external secrets manager (e.g. 1Password) so managed auth connections can look up credentials at login time instead of storing them in Kernel.

​
kernel credential-providers create

Register a new credential provider.
FlagDescription
--provider-type <type>Provider type (e.g. onepassword).
--name <name>Human-readable name for this provider instance.
--token <token>Service account token for the provider.
--cache-ttl <seconds>How long to cache credential lists (default: 300).
--output json, -o jsonOutput raw JSON object.

​
kernel credential-providers list

List credential providers.
FlagDescription
--output json, -o jsonOutput raw JSON array.

​
kernel credential-providers get <id>

Get a credential provider by ID.
FlagDescription
--output json, -o jsonOutput raw JSON object.

​
kernel credential-providers list-items <id>

List items available from a credential provider.
FlagDescription
--output json, -o jsonOutput raw JSON array.

​
kernel credential-providers test <id>

Test the connection to a credential provider.
FlagDescription
--output json, -o jsonOutput raw JSON object.

​
kernel credential-providers update <id>

Update a credential provider.
FlagDescription
--name <name>New human-readable name.
--token <token>New service account token (to rotate credentials).
--cache-ttl <seconds>How long to cache credential lists.
--enabledWhether the provider is enabled for credential lookups.
--priority <n>Priority for credential lookups (lower numbers are checked first).
--output json, -o jsonOutput raw JSON object.

​
kernel credential-providers delete <id>

Delete a credential provider.