Browser login
Last updated: Aug 12, 2026
Browser login signs you in to the Fluid Attacks CLI. You authenticate once through your browser, the CLI receives a short-lived token, and nothing long-lived is stored on your machine.
It is meant for scans you run yourself, on your own machine. Pipelines authenticate as a group instead — see Authentication.
How it works
- You run
login. The CLI opens your browser. - You sign in to the platform as usual and approve the request.
- The browser hands the CLI a short-lived token, and the CLI stores the session.
- Later runs reuse that session until it expires. No token is pasted anywhere.
Sign in
Every Fluid Attacks CLI accepts the same three commands. Use whichever one you already have installed:
ss login # signs you in
ss whoami # reports who you are and how you authenticated
ss logout # ends the session and removes it from this machinelogin prints the URL it is opening,
so you can paste it into a browser yourself if it does not open automatically.
It waits five minutes for you to finish, then gives up.
One login serves every CLI. Signing in with ss login also signs in cs,
sast, sca, mast, dast, cspm, melts and forces. You do not sign
in once per scanner.
To check that your session can act for a specific group, name it:
ss whoami --group your-groupHow long a session lasts
The token the CLI uses expires after one hour, and the CLI renews it for you without asking.
The session as a whole lasts eight hours — about a workday.
After that, run login again.
logout ends the session immediately,
both on this machine and on the platform.
Run it on any machine you share.
Where the session is kept
| System | Location |
|---|---|
| macOS | Your login keychain, under fluidattacks-platform-session |
| Linux | ~/.config/fluidattacks/oauth.json, readable only by you |
On macOS, the first time each CLI reads the session, the system asks whether that program may use the keychain item. Approving once per program is expected: access is granted by you, not assumed.
When a browser login is not used
The CLI prefers a credential you supplied explicitly.
If INTEGRATES_API_TOKEN is set, or the run is in a CI/CD job that federates
with OpenID Connect, that credential is used and your browser login is ignored.
login tells you so and refuses, rather than storing a session that would never be used.
To sign in as yourself, unset the variable first:
unset INTEGRATES_API_TOKEN
ss loginRequirements
- Linux or macOS. Browser login is not available on Windows.
- A browser on the same machine. The CLI receives the response on a local address, so the browser has to run where the CLI runs.
Browser login does not work inside a container, and it is not meant to. A container has no browser and cannot receive the response. Authenticate containerized and CI/CD scans as a group instead, with OIDC federation or a Group token.
A personal API token is a different credential again: it authenticates you to the GraphQL API, not a scan — see API basics.
Authentication
Authenticate Fluid Attacks CLI scans: sign in through your browser for runs on your own machine, or authenticate pipelines as a group with OpenID Connect or a Group token.
OIDC federation
Set up token-less OpenID Connect (OIDC) federation so your CI/CD pipelines authenticate to Fluid Attacks without a stored secret.