Authentication¶

bnerd uses bearer token authentication to communicate with the CloudAPI. There are several ways to provide your credentials.

Interactive Login (Recommended)¶

The easiest way to authenticate:

bnerd login

This interactive command prompts you for:

1. API URL
2. Email and password
3. Organization selection (if you belong to multiple)

Your token and organization ID are saved to ~/.bnerd.yaml automatically.

Authentication Methods¶

Method 1: Config File¶

Store your credentials in ~/.bnerd.yaml:

api-url: https://api.bnerd.net
token: your-bearer-token
org-id: your-organization-id

# Or use config commands:
bnerd config set token YOUR_TOKEN
bnerd config set org-id YOUR_ORG_ID

Method 2: Environment Variables¶

export BNERD_TOKEN=your-bearer-token
export BNERD_ORG_ID=your-organization-id
export BNERD_API_URL=https://api.bnerd.net

This is ideal for CI/CD pipelines and scripts where you don't want a config file.

Method 3: Command-Line Flags¶

bnerd --token YOUR_TOKEN --org-id YOUR_ORG_ID dns zones list

Useful for one-off commands or testing with different credentials.

Precedence¶

When the same setting is provided via multiple methods, bnerd uses this priority:

1. CLI flags (highest priority)
2. Environment variables
3. Config file
4. Defaults (lowest priority)

Verify Authentication¶

Check who you're authenticated as:

bnerd whoami

This shows your current account details and confirms your token is valid.

Required Credentials by Command Type¶

Tips¶

• Rotate your token periodically — use bnerd login to get a fresh one
• In CI/CD, use environment variables instead of config files
• Use --debug to see the actual HTTP requests if authentication fails