wendy cloud login
Log in to Wendy Cloud or a local pki-core instance
Syntax
wendy cloud login [flags]Examples
wendy cloud login --helpArguments
No positional arguments are declared in the command synopsis.
Flags
Flags below include inherited options. Types and defaults come from the CLI source. An empty default means no value is configured.
| Flag | Type | Default | Description |
|---|---|---|---|
--api-key | string | (empty) | Bearer API key for local pki-core authentication |
--auth | string | https://auth.dev.wendy.sh | wendy-auth base URL used with --email |
--client-id | string | wendy-cli | public DPoP OAuth client ID registered in wendy-auth |
--cloud | string | (empty) | Cloud dashboard URL |
--cloud-grpc | string | (empty) | Cloud gRPC endpoint, or local pki-core address (host:port) when using --api-key |
--device | string | (empty) | Target device hostname; wendy run accepts a comma-separated list to deploy one build to several devices (needs a remote build host and --detach). Defaults to $WENDY_DEVICE, then the saved default device |
--email | string | (empty) | Email address used to discover your organization and sign in with wendy-auth |
--issuer | string | (empty) | wendy-auth realm issuer URL, e.g. https://auth.wendy.sh/realms/acme (enables OIDC login) |
--json | bool | false | Output in JSON format |
--legacy | bool | false | Use the old Wendy Cloud dashboard enrollment flow (cloud.wendy.sh) (the temporary default unless --email, --issuer, or --api-key is provided) |
--org | int32 | 1 | Organization ID for --api-key local login. For Wendy Cloud, each login is stored as an auth context; switch with 'wendy auth use <context>'. |
--pki-identity-endpoint | string | https://identity.dev.pki.wendy.sh/v1/identity/certificate | pki-core operator identity CSR endpoint (used with OIDC login) |
--pki-resource | string | https://pki.wendy.sh/identity | RFC 8707 pki-core identity resource (used with OIDC login) |
--print-claims | bool | false | Print the decoded access-token claims after login (used with --issuer) |
--resource | string | (empty) | RFC 8707 API resource indicator (used with OIDC login) |
--service-account | string | (empty) | Service-account key file for headless login (or set WENDY_SERVICE_ACCOUNT_KEY to its contents) |
Output
Output depends on the operation and selected target. Command behavior and detailed examples.
JSON output
The global --json option requests machine-readable output. The CLI also selects JSON mode when no interactive terminal is attached. Support and payloads are command-specific; this flag does not guarantee a single JSON document for commands that stream logs or invoke build tools. Consult Details before parsing command output.
Exit codes
The CLI entry point returns 0 on success and for its user-cancelled or default-cleared results. Other returned errors exit with 1 and print a diagnostic to stderr. Some operations may terminate through subprocess or signal handling; do not infer application health from the CLI exit code alone.
Common errors
Check argument values and flag combinations against the synopsis above. For discovery, build, port, and readiness failures, see deployment troubleshooting. Command-specific constraints are in Details.
See also
Details
Signs in to Wendy Cloud. For now, defaults to the legacy dashboard login (cloud.wendy.sh). For the OIDC flow, pass --email to discover your realm (or --issuer to name it), sign in with authorization code + PKCE, obtain an operator certificate directly from pki-core, and save a refreshable Cloud API session. With --api-key: issues a certificate from a self-hosted pki-core instance using a Bearer API key. With --service-account <key-file> (or WENDY_SERVICE_ACCOUNT_KEY): signs in headlessly as a wendy-auth service account; no browser or terminal is needed. With --legacy: uses the old Wendy Cloud dashboard enrollment callback (cloud.wendy.sh). Kept for the previous cloud only.