Authentication

enumctl stores your credentials locally in ~/.config/enumctl/.

Register

enumctl auth register

Creates an enum account. enumctl asks for your details, emails a code to confirm the address, and logs you in once it is confirmed.

If you left the code prompt, confirm the address later with enumctl auth verify-email, or request a new code with enumctl auth resend-email.

You can stay logged in as more than one user. enumctl auth login logs in the user of the profile in use and keeps the others.

Login

enumctl auth login

On a machine with a browser, enumctl opens one automatically and completes login via a localhost callback.

On headless machines (SSH sessions, remote servers), enumctl uses device authorization by default: open the printed URL on any device, sign in, and enumctl picks up the session automatically. Force device authorization explicitly with:

enumctl auth login --device

Flag	Description
--device	Use device authorization (for headless or SSH sessions)
--browser	Force browser callback login even on SSH sessions

Logout

enumctl auth logout

Logs out the user of the profile in use and removes its stored credentials. Other users stay logged in. Profiles of the logged-out user lose their organization and project, because the next user on the profile may not have access to them.

enumctl auth logout --all

Logs out every user.

Flag	Description
--all	Log out every user

Get token

enumctl auth get-token

Outputs the current access token in Kubernetes ExecCredential format. This is used internally by kubectl. You typically don’t need to run this directly.

Troubleshooting

Session expired or invalid:

enumctl auth logout
enumctl auth login

Debug logging:

enumctl auth login --verbose

Check config directory:

ls -la ~/.config/enumctl/