Authentication
enum uses OIDC-based authentication. All credentials are stored locally in ~/.config/enumctl/.
enumctl auth loginOn a machine with a browser, enumctl opens one automatically and completes login via a localhost callback.
On headless machines (SSH sessions, remote servers), enumctl uses device authorization by default: open the printed URL on any device, sign in, and enumctl picks up the session automatically. Force device authorization explicitly with:
enumctl auth login --device| Flag | Description |
|---|---|
--device | Use device authorization (for headless or SSH sessions) |
--browser | Force browser callback login even on SSH sessions |
Logout
Section titled “Logout”enumctl auth logoutRemoves stored credentials from your machine.
Get token
Section titled “Get token”enumctl auth get-tokenOutputs the current access token in Kubernetes ExecCredential format. This is used internally by kubectl. You typically don’t need to run this directly.
Troubleshooting
Section titled “Troubleshooting”Session expired or invalid:
enumctl auth logoutenumctl auth loginDebug logging:
enumctl auth login --verboseCheck config directory:
ls -la ~/.config/enumctl/