Browser login
Last updated: Oct 27, 2026
Browser login signs you in to the Fluid Attacks CLI. You authenticate once through your browser, the CLI receives a short-lived token, and nothing long-lived is stored on your machine.
Use it for scans that you run yourself, on your own machine. Pipelines authenticate as a group. For more information, read Authentication.
How it works
- You run
login. The CLI opens your browser. - You sign in to the platform as usual and approve the request.
- The browser hands the CLI a short-lived token, and the CLI stores the session.
- The subsequent runs use that session again until it expires. You do not paste a token anywhere.
Sign in
All the Fluid Attacks CLIs accept the same three commands. Use the CLI that you have installed:
ss login # signs you in
ss whoami # reports who you are and how you authenticated
ss logout # ends the session and removes it from this machinelogin prints the URL that it opens.
If the browser does not open automatically, paste the URL in a browser.
login waits five minutes for you to sign in, and then it stops.
One login serves every CLI. Signing in with ss login also signs in cs,
sast, sca, mast, dast, cspm, melts and forces. You do not sign
in once per scanner.
To make sure that your session can act for a group, write the name of the group:
ss whoami --group your-groupHow long a session lasts
The token the CLI uses expires after one hour, and the CLI renews it for you without asking.
The full session lasts eight hours, approximately one workday.
After that, run login again.
logout ends the session immediately,
on this machine and on the Fluid Attacks platform.
Run it on any machine you share.
Where the session is kept
| System | Location |
|---|---|
| macOS | Your login keychain, under fluidattacks-platform-session |
| Linux | ~/.config/fluidattacks/oauth.json, readable only by you |
On macOS, the first time each CLI reads the session, the system asks whether that program may use the keychain item. Approving once per program is expected: access is granted by you, not assumed.
When a browser login is not used
If you give the CLI a different credential,
the CLI uses that credential and not your browser login.
This occurs when INTEGRATES_API_TOKEN has a value,
or when the run is in a CI/CD job that federates with OpenID Connect.
If this occurs, login tells you and stops.
It does not keep a session that the CLI cannot use.
To sign in as yourself, unset the variable first:
unset INTEGRATES_API_TOKEN
ss loginRequirements
- Linux or macOS. Browser login is not available on Windows.
- A browser on the same machine. The CLI receives the response on a local address, so the browser has to run where the CLI runs.
Browser login does not work inside a container, and it is not meant to. A container has no browser and cannot receive the response. Authenticate containerized and CI/CD scans as a group instead, with OIDC federation or a Group token.
A personal API token is a different credential. It authenticates you to the GraphQL API, not to a scan. For more information, read API basics.
Authentication
Authenticate Fluid Attacks CLI scans: sign in through your browser for runs on your own machine, or authenticate pipelines as a group with OpenID Connect or a Group token.
OIDC federation
Set up token-less OpenID Connect (OIDC) federation so your CI/CD pipelines authenticate to Fluid Attacks without a stored secret.