Authentication
There are two ways to authenticate against the CLI:
Federated authentication
This is the most common scenario. You should just use the following command to log in:
> conveyor auth login
Access key and secret key
When you want to integrate Conveyor within your CI/CD pipelines, the best way to set it up is to use the following environment variables to authenticate:
> export CONVEYOR_AUTH_KEY=XX
> export CONVEYOR_AUTH_SECRET=YY
These key/secret pairs belong to a service account, Conveyor's identity for machine users such as CI/CD pipelines. Like a regular user, a service account is granted a role through RBAC:
- Admin: installation-wide access, equivalent to an admin user.
- Scoped: contributor access limited to a chosen set of projects and environments, so the impact of a leaked credential is bounded.
Installation admins manage service accounts from the Service Accounts tab on the settings page. From there you can create a service account, pick its type, and, for a scoped account, select the projects and environments it applies to. Each service account can hold up to two key/secret pairs at a time, so credentials can be rotated without downtime: generate a new pair, switch your pipelines over to it, then revoke the old one.
To get the access key and secret, open the service account on the Service Accounts tab and reveal or copy the secret from there.
When using this method of authentication and doing frequent calls (more then 1 call per hour), we recommend caching the access token until it expires.