CLI Authentication

kubeadapt authenticates to the Kubeadapt API using a Bearer token. Generate an API key from the Kubernetes cost dashboard at app.kubeadapt.io, then store it in the config file, pass it as an environment variable, or supply it inline with flags.

Run auth login to store your API key:

bash

kubeadapt auth login

The command prompts for your API key (input is hidden). You can skip the prompt by passing the key directly:

bash

kubeadapt auth login --api-key ka_your_key --api-url https://public-api.kubeadapt.io

Credentials are saved to ~/.kubeadapt/config.yaml with 0600 permissions (owner read/write only). The directory is created with 0700 permissions if it doesn't exist.

Tip

The --api-url flag on auth login sets the API URL in the saved config. If you omit it, the URL defaults to http://localhost:8002. For production use, always pass --api-url https://public-api.kubeadapt.io.

Check status

To see the currently stored credentials:

bash

kubeadapt auth status

The API key is masked in the output. You'll see something like:

text

API URL:  https://public-api.kubeadapt.io
API Key:  ka_y...r_key

Logout

To remove the stored API key from the config file:

bash

kubeadapt auth logout

This clears the api_key field in ~/.kubeadapt/config.yaml. The file itself is not deleted.

Using environment variables

For CI/CD pipelines or scripts where you don't want to write a config file, set KUBEADAPT_API_KEY and KUBEADAPT_API_URL as environment variables. See Configuration: Environment variables for the full reference.

bash

export KUBEADAPT_API_KEY=ka_your_key
export KUBEADAPT_API_URL=https://public-api.kubeadapt.io
kubeadapt get clusters

Using flags

You can pass credentials directly on any command with --api-key and --api-url:

bash

kubeadapt --api-key ka_your_key --api-url https://public-api.kubeadapt.io get clusters

Note

When the same setting appears in multiple places, flags take precedence over environment variables, which take precedence over the config file. See Configuration: Precedence for the full resolution order.

GitHub Actions example

yaml

- name: Check pending savings
  env:
    KUBEADAPT_API_KEY: ${{ secrets.KUBEADAPT_API_KEY }}
    KUBEADAPT_API_URL: https://public-api.kubeadapt.io
  run: |
    kubeadapt get recommendations --status pending -o json

Store KUBEADAPT_API_KEY in your repository's encrypted secrets. Never hardcode API keys in workflow files.

Troubleshooting

Error	Cause	Fix
`401 Unauthorized`	Invalid or expired API key	Regenerate at app.kubeadapt.io and run `auth login` again
`connection refused`	Wrong API URL or network issue	Check `auth status` and verify `--api-url` points to `https://public-api.kubeadapt.io`
`permission denied` on config file	File permissions too open	Run `chmod 0600 ~/.kubeadapt/config.yaml`

Login

Check status

Logout

Using environment variables

Using flags

GitHub Actions example

Troubleshooting