title: 'login' sidebar_label: 'login' pagination_prev: null pagination_next: null tags:
Login to the Spice.ai Platform, or other services with sub-commands.
-h, --help Print this help message-k, --key string API key (for spice.ai)-o, --output string Where to store the resulting credentials. One of env (default; appends to a local .env file), json (prints the credentials as JSON to stdout), or keychain (stores them in the platform keychain, e.g. macOS Keychain).:::note
--output applies to spice login itself (the Spice.ai login, with or without --key). The provider subcommands below always write to .env.
:::
abfs Login to a Azure Storage Accountdatabricks Login to a Databricks instancedelta-lake Configure credentials to access a Delta Lake tabledremio Login to a Dremio instancepostgres Login to a Postgres instances3 Login to an s3 storagesharepoint Login to a Microsoft 365 sharepoint accountsnowflake Login to a Snowflake warehousespark Login to a Spark Connect remoteRunning spice login without --key prints an auth code, opens the Spice.ai authorization page, and then polls the token exchange once per second while the browser flow is completed.
Authentication timed out. Please try again. — followed by the last retryable error, when there was one. It does not poll indefinitely.Access denied without waiting out the deadline, as does a rejection the endpoint cannot answer differently on a retry (for example 400, 401, 403, or 410).5xx), 408, 429, and network failures are retried until the deadline. So is 404, which is the normal answer while the auth code has not been authorized yet — but an endpoint that answers 404 for the whole 5 minutes (typically a SPICE_BASE_URL pointing at the wrong deployment) stops at the deadline and says so.spice cloud login subscription polls the same endpoint under the same 5-minute deadline.
The auth code, device code, and access token in these flows are sent in the request body, which an HTTP 307 or 308 redirect replays verbatim to the redirect target. The CLI's credential-bearing HTTP clients therefore follow redirects only within the same origin (scheme, host, and port), and refuse any hop that leaves it rather than forwarding the credential to another host. This applies to the spice login flows, the Spice Cloud client, and the CLI's own runtime and Cloud Platform requests made with --api-key.
An off-origin redirect surfaces as the 3xx response itself rather than as a transport error, so a misconfigured endpoint stays diagnosable.
spice cloud loginAuthenticate with the Spice Cloud Platform. See spice cloud (opens in a new tab) for the rest of the Spice Cloud command surface.
Running spice cloud login with no subcommand offers two choices — Login with a web browser and Paste an access token — which run subscription and token respectively. The chooser needs an interactive terminal; non-interactive callers must name a method. api is not offered in the chooser and is always named explicitly.
spice cloud login subscriptionBrowser-based OAuth login flow. Automatically opens a browser for authentication.
Use --device to print the URL and one-time code without opening a browser (useful for SSH/headless environments):
spice cloud login tokenAuthenticate with a Spice Cloud access token. Alias: pat.
Omit --token to enter the token at a secure prompt. Generate one at /account/tokens in the Spice Cloud portal.
The token can also be provided via the SPICE_CLOUD_PAT environment variable:
spice cloud login apiAuthenticate using OAuth2 client credentials for CI/automation workflows.
Credentials can also be provided via environment variables:
| Variable | Used by | Description |
|---|---|---|
SPICE_CLOUD_PAT | login token | Spice Cloud access token |
SPICE_CLOUD_CLIENT_ID | login api | OAuth2 client ID |
SPICE_CLOUD_CLIENT_SECRET | login api | OAuth2 client secret |