Authenticate UiPath CLI using interactive OAuth2, External App credentials, or environment-variable token flows.

UiPath CLI supports five authentication flows: a developer on a laptop, a CI/CD pipeline calling Orchestrator with an External Application, a CI/CD platform that can issue its own OIDC tokens instead of holding a long-lived secret, a container or ephemeral runner that already holds an access token, and a process running alongside a local UiPath Robot. The first three end at the same place — an authenticated session persisted to a credentials folder that every subsequent uip command reuses — but they differ in how they obtain the token and how the CLI refreshes it. The fourth bypasses on-disk state entirely. The fifth defers to the Robot's own identity over a local IPC channel.

uip logout clears any on-disk credentials from the first three flows. The env-var flow has nothing to clear — unset the env vars. Robot credentials have nothing to clear either — the Robot owns the identity.

Run uip login with no arguments:

uip opens your default browser on UiPath's sign-in page. After you authenticate, UiPath redirects back to a local callback that uip is listening on, and the CLI prompts you to pick a tenant. When the tenant is selected, the session is saved and you are done.

Useful flags:

By default, the session is stored inside a .uipath/ folder. uip looks for this folder in three places, in order:

When no .uipath/ exists anywhere on the walk-up chain, uip login creates one at ~/.uipath/. Treat the folder's contents as opaque — they are managed by uip login, uip login tenant set, and uip logout.

The session stores a single active tenant at a time. Switch without re-running the full login flow:

uip login status shows the current organization, tenant, and token expiration.

uip refreshes access tokens in the background when they are near expiry. You do not need to re-run uip login unless the refresh token itself expires or is revoked, or you change tenants/organizations.

uip login normally opens your system browser. In a headless environment — a CI driver that needs a real user identity (with a refresh token) rather than an External App, but has no display — pass --no-browser (or set UIPATH_CLI_NO_BROWSER=true):

This keeps the entire interactive flow (PKCE, state, local callback, token save) but does not launch a browser. Instead it prints the authorize URL to stderr as a stable marker line:

An external automation (for example, a Playwright script) reads that line, opens the URL in a browser it controls, completes sign-in, and the identity provider redirects to uip's local callback as usual — completing the login the same way as if a human had clicked through.

The printed URL is safe to appear in CI logs: it carries only public OAuth values (PKCE code_challenge, state, client_id, redirect_uri, scope) — no secret and no token. --no-browser has no effect on Flow 2 or Flow 3 (client-credentials and federated login never open a browser regardless) — a warning is logged if you pass it alongside --client-secret or --client-assertion.

Create an External Application in UiPath (Automation Cloud: Admin → External Applications) with:

Copy the generated App ID and App Secret, and store them in the pipeline's secret store (GitHub Actions secrets, Azure DevOps variable groups, Jenkins credentials, Vault, etc.).

Sign in from the pipeline:

--client-id and --client-secret accept either a literal value or the special prefix env. that resolves to an environment variable at runtime. env.UIPATH_CLIENT_ID means "read the value from the UIPATH_CLIENT_ID environment variable". This keeps secret values out of shell history and process listings — unlike --client-secret "$UIPATH_CLIENT_SECRET", which expands on the command line.

Literal values still work:

If the External App has multiple scopes and you want a narrower session for a specific script, pass --scope:

For CI/CD platforms that can mint their own OIDC token — no External App client secret to create, store, or rotate:

--client-assertion takes an OIDC JWT in place of --client-secret, and — like --client-id/--client-secret — accepts the env. prefix to read the token from an environment variable at runtime (recommended: passing the raw JWT as a literal value prints a warning, since it would otherwise be visible in shell history and process listings).

Rules enforced by uip login:

Once authenticated, the session behaves like an External App session: it's persisted, refreshed automatically, and cleared with uip logout.

Some environments — containers built by another pipeline, scheduled jobs, test fixtures — already hold a valid UiPath access token and have no need for interactive sign-in or client-credentials exchange. Enable the env-var auth flow by setting:

With UIPATH_CLI_ENABLE_ENV_AUTH=true, every uip invocation authenticates from these variables and bypasses the .uipath/ folder entirely. There is no uip login step and nothing is written to disk.

Example GitHub Actions step using env-var auth:

UIPATH_CLI_AUTH_TOKEN also accepts a UiPath Personal Access Token (PAT — an opaque "reference token"), minted with uip admin pat create and managed with uip admin pat list/revoke/regenerate. A PAT is not a JWT, so it carries no iss claim — which changes one rule from above:

For processes running alongside a local UiPath Robot — Studio Desktop and other Robot-hosted contexts — authentication can defer entirely to the Robot's own identity over a local IPC channel, instead of any token the CLI manages itself:

With the gate set, uip talks to the Robot's IPC endpoint for both the access token and the resource base URL, bypassing the .uipath/ credentials folder and the env-var flow entirely. UIPATH_CLI_ENFORCE_ROBOT_AUTH and UIPATH_CLI_ENABLE_ENV_AUTH are mutually exclusive — setting both is an error, not a silent override. There is no uip login step, no refresh to manage, and nothing for uip logout to clear.

logout clears the stored session inside .uipath/. On the env-var flow there is nothing to remove — unset the variables.

Either no .uipath/ folder was found on the walk-up chain, or the stored session is unreadable. Run uip login (or set the env-var flow) and retry.

Interactive and External App sessions refresh automatically when near expiry. If you see Expired, the refresh token itself expired or was revoked — re-run uip login. For env-var auth, rotate UIPATH_CLI_AUTH_TOKEN.

Pass --organization <logical-name> on uip login to bypass the org picker, or uip login tenant list after the fact to see what the session is actually bound to.

The interactive flow opens a local callback port on 127.0.0.1. Most proxies leave loopback alone, but some aggressive setups block it. Work around by using Flow 2 (External App), Flow 3 (federated credentials), or Flow 4 (env-var auth) — all three avoid the browser callback entirely.