Authentication with tcloud CLI

This guide covers how to authenticate with the Thalassa Cloud Platform using the tcloud CLI.

Authentication Methods

The tcloud CLI supports two authentication methods:

1. Personal Access Token (PAT)
2. OIDC Authentication

Personal Access Token (PAT)

Personal Access Tokens are the most common and straightforward way to authenticate with Thalassa Cloud.

Creating a Personal Access Token

1. Log in to your Thalassa Cloud Console
2. In the top right, navigate to /personal-access-tokens
3. Click “Create Personal Access Token”
4. Give your token a descriptive name
5. Select the appropriate permissions
6. Optionally, configre the expiry date (recommended).
7. Copy the generated token (you won’t be able to see it again)

Using a Personal Access Token

Method 1: Create a Context (Recommended)

tcloud context create my-context \
  --api=https://api.thalassa.cloud \
  --token=your-personal-access-token

Method 2: Use Global Flags

tcloud --api=https://api.thalassa.cloud \
  --token=your-personal-access-token \
  me

Optionally, you can also use the --organisation for logging directly for a specific organisation. By default, it will select the first organisation you are a member of. You can always switch between organisations by using tcloud context use-organisation <organisation>.

Security Best Practices

• Never commit tokens to version control
• Rotate tokens regularly
• Use the minimum required permissions
• Store tokens securely (use your system’s keychain or a password manager)

Context Management

Contexts allow you to manage multiple authentication configurations and switch between them easily.

Creating Contexts

# Create a production context
tcloud context create production \
  --api=https://api.thalassa.cloud \
  --token=prod-token \
  --organisation=my-org

# Create a staging context
tcloud context create staging \
  --api=https://staging-api.thalassa.cloud \
  --token=staging-token \
  --organisation=my-org-staging

Listing Contexts

tcloud context list

Switching Contexts

# Use a specific context
tcloud --context=production me

# Set default context
tcloud context use production

Deleting Contexts

This deletes the current context.

tcloud context delete

Verifying Authentication

After setting up authentication, verify it’s working:

tcloud me organisations

You should see output similar to:

ID                      NAME            SLUG
d0nm4fiacp3nbhm3nv2g    my company      my-company-betyt