UiPath Documentation
uipath-cli
latest
false
UiPath CLI user guide

uip login

Syntax and options for `uip login`, which authenticates UiPath CLI against UiPath Cloud and persists the session locally.

uip login authenticates the CLI against UiPath Cloud and persists the resulting session inside a local .uipath/ folder. On success, the CLI has an access token and a selected tenant; tools run by subsequent commands pick these up automatically. See Authentication for the credential model and Sessions and credentials for where the folder lives.

For checking status, see uip login status. To tear down a session, see uip logout.

Synopsis​

uip login [--tenant <name>] [--organization <name>]
         [--authority <url>] [--client-id <id>] [--client-secret <secret>]
         [--client-assertion <jwt>] [--scope <scopes>] [--no-browser] [-f <folder>]
uip login status
uip login refresh [--login-validity <minutes>]
uip login which
uip login tenant list [-f <folder>]
uip login tenant set <name> [-f <folder>]
uip login profiles list [--all-fields]
uip login profiles delete [profile-name] [--all] -y
uip login [--tenant <name>] [--organization <name>]
         [--authority <url>] [--client-id <id>] [--client-secret <secret>]
         [--client-assertion <jwt>] [--scope <scopes>] [--no-browser] [-f <folder>]
uip login status
uip login refresh [--login-validity <minutes>]
uip login which
uip login tenant list [-f <folder>]
uip login tenant set <name> [-f <folder>]
uip login profiles list [--all-fields]
uip login profiles delete [profile-name] [--all] -y

Every uip login subcommand honors the global options (--output, --output-filter, --log-level, --log-file, --profile, --interactive/--no-interactive). Exit codes follow the standard contract.

uip login​

Authenticates interactively through the browser, or non-interactively using External Application client credentials or a federated (workload-identity) OIDC token.

Arguments​

None.

Options​

  • -f, --file <folder> — Path to a credentials folder. The session is persisted inside <folder>. Without it, the CLI uses the default location (see Sessions and credentials). Mutually exclusive with the global --profile flag.
  • --authority <url> — Custom authority URL, for example https://cloud.uipath.com (default), https://govcloud.uipath.us (Public Sector), or an Automation Suite host. The https:// prefix can be omitted (cloud.uipath.com works).
  • --client-id <id> — Client ID or Application ID for a UiPath External Application. Accepts env.NAME to read from an environment variable.
  • --client-secret <secret> — Client secret for a confidential External Application. Accepts env.NAME to read from an environment variable. Mutually exclusive with --client-assertion.
  • --client-assertion <jwt> — OIDC token (JWT) for federated login (workload identity), used instead of a client secret. Accepts env.NAME (recommended) to read from an environment variable — passing the raw token as a literal value prints a warning, since it would otherwise land in shell history, process listings, and CI logs. Requires --client-id. Mutually exclusive with --client-secret.
  • -s, --scope <scopes> — Comma- or space-separated scopes (for example, "OR.Folders OR.Jobs"). Use with External Application or federated credentials.
  • -t, --tenant <name> — Tenant name (non-interactive mode). If omitted, pair with the global --interactive flag so the CLI can prompt for one.
  • --organization <name> — Organization logical name, pre-selected during browser login. Bypasses the org picker when your user is in multiple organizations. Ignored (with a warning) when using client credentials or federated login — the organization is fixed by --client-id in those flows.
  • --no-browser — Don't open a browser; print the authorize URL to stderr (prefixed UIPATH_AUTH_URL <url> for automation to grep) and block until the sign-in callback arrives. For headless/automation-driven login. Also settable via UIPATH_CLI_NO_BROWSER=true. Has no effect (and is ignored, with a warning) when using client credentials or federated login — no browser is opened in those flows either way. When a person will do the sign-in, have them run the command in their own terminal — running it through an agent's shell tool hides the printed URL from them.

This page also documents two flags that are not login-specific — see Global options for the full behavior:

  • --interactive / --no-interactive — after authentication, force (or suppress) the interactive prompt to select a tenant from the list returned by the cloud. There is no --it short form.
  • --profile <name> — use a named, saved login profile instead of the default credentials location. Mutually exclusive with -f, --file.

Credential modes​

  • Interactive / user credentials — run uip login (optionally with --interactive, --tenant, or --organization). The browser flow completes on the UiPath Cloud authority; the resulting tokens are persisted inside the credentials folder.
  • External Application (client credentials, non-interactive) — pass --client-id, --client-secret, and --scope, typically with --tenant. Suitable for CI runners. Read the secret from an environment variable with --client-secret env.UIPATH_CLIENT_SECRET to keep it out of your shell history.
  • Federated / workload identity (non-interactive) — pass --client-id and --client-assertion (an OIDC JWT obtained from your CI provider or workload identity broker in a prior step) instead of a client secret. --client-secret and --client-assertion cannot be combined.

Examples​

# Browser-based interactive login, picks tenant at the end
uip login --interactive

# Log directly into a known org + tenant (no browser picker)
uip login --organization my-org --tenant DefaultTenant

# Log in to a non-default authority, e.g. an Automation Suite host
uip login --authority automation.acme-corp.com --tenant DefaultTenant

# External Application with secret from environment variable
uip login \
  --client-id "00000000-0000-0000-0000-000000000001" \
  --client-secret env.UIPATH_CLIENT_SECRET \
  --scope "OR.Folders OR.Jobs" \
  --tenant DefaultTenant

# Federated login (workload identity) — the OIDC token comes from your CI provider
uip login \
  --client-id "00000000-0000-0000-0000-000000000001" \
  --client-assertion env.CI_OIDC_TOKEN \
  --tenant DefaultTenant

# Headless / automation-driven login: print the authorize URL instead of opening a browser
uip login --no-browser --tenant DefaultTenant

# Custom credentials folder (useful for scoping per-project sessions)
uip login --interactive -f ./.uipath
# Browser-based interactive login, picks tenant at the end
uip login --interactive

# Log directly into a known org + tenant (no browser picker)
uip login --organization my-org --tenant DefaultTenant

# Log in to a non-default authority, e.g. an Automation Suite host
uip login --authority automation.acme-corp.com --tenant DefaultTenant

# External Application with secret from environment variable
uip login \
  --client-id "00000000-0000-0000-0000-000000000001" \
  --client-secret env.UIPATH_CLIENT_SECRET \
  --scope "OR.Folders OR.Jobs" \
  --tenant DefaultTenant

# Federated login (workload identity) — the OIDC token comes from your CI provider
uip login \
  --client-id "00000000-0000-0000-0000-000000000001" \
  --client-assertion env.CI_OIDC_TOKEN \
  --tenant DefaultTenant

# Headless / automation-driven login: print the authorize URL instead of opening a browser
uip login --no-browser --tenant DefaultTenant

# Custom credentials folder (useful for scoping per-project sessions)
uip login --interactive -f ./.uipath

Data shape (--output json)​

{
  "Code": "Authenticated",
  "Data": {
    "Status": "Logged in",
    "Organization": "my-org",
    "Tenant": "DefaultTenant"
  }
}
{
  "Code": "Authenticated",
  "Data": {
    "Status": "Logged in",
    "Organization": "my-org",
    "Tenant": "DefaultTenant"
  }
}

Failure modes​

  • Missing tenant after a non-interactive login raises a ConfigError with Message: "No tenant selected" and instructs you to re-run with --tenant <name> or --interactive.
  • Transport errors and non-2xx responses from the authority surface as AuthenticationError, with the original HTTP status in Context.httpStatus when available.
  • A malformed env.NAME reference in --client-id / --client-secret produces a ConfigError before any network call.

uip login refresh​

Proactively refresh the access token and emit a machine-readable session payload (access token, org/tenant identity, expiration). Intended for programmatic consumers (for example an IDE extension) that need a guaranteed-valid token for the next few minutes — unlike uip login status, which is a status report and only rotates the token incidentally when it has already expired, refresh forces a rotation ahead of time when needed.

Arguments​

None.

Options​

  • --login-validity <minutes> — refresh only if the current access token expires within this many minutes. Default 5. Pass 0 to skip the proactive check and only rotate if the token is already expired. Range 0–525600 (one year).

Examples​

# Refresh and print a token guaranteed valid for the next 5 minutes (the default)
uip login refresh --output json

# Require at least 10 minutes of validity, forcing a refresh if the token expires sooner
uip login refresh --login-validity 10 --output json
# Refresh and print a token guaranteed valid for the next 5 minutes (the default)
uip login refresh --output json

# Require at least 10 minutes of validity, forcing a refresh if the token expires sooner
uip login refresh --login-validity 10 --output json

Data shape (--output json)​

{
  "Code": "LoginRefresh",
  "Data": {
    "Status": "Logged in",
    "Organization": "my-org",
    "Tenant": "DefaultTenant",
    "Expiration Date": "2026-04-18T10:30:00Z",
    "BaseUrl": "https://cloud.uipath.com",
    "OrganizationId": "00000000-0000-0000-0000-000000000001",
    "OrganizationName": "my-org",
    "TenantId": "00000000-0000-0000-0000-000000000002",
    "TenantName": "DefaultTenant",
    "AccessToken": "<jwt>"
  }
}
{
  "Code": "LoginRefresh",
  "Data": {
    "Status": "Logged in",
    "Organization": "my-org",
    "Tenant": "DefaultTenant",
    "Expiration Date": "2026-04-18T10:30:00Z",
    "BaseUrl": "https://cloud.uipath.com",
    "OrganizationId": "00000000-0000-0000-0000-000000000001",
    "OrganizationName": "my-org",
    "TenantId": "00000000-0000-0000-0000-000000000002",
    "TenantName": "DefaultTenant",
    "AccessToken": "<jwt>"
  }
}
Important:

AccessToken is only included when --output json is in effect and either --output was passed explicitly or stdout is non-interactive (piped/redirected). A bare, interactive uip login refresh in a terminal never prints the token — this is deliberate, so the token doesn't land in scrollback by accident. Code is LoginRefreshPartial instead of LoginRefresh when the refreshed token could not be persisted back to disk (the caller still gets a valid, usable token for the current process).

Failure modes​

  • Not logged in, refresh failed, or the token expired with no refresh token available: AuthenticationError, exit code 2, with Instructions naming the specific cause.

uip login which​

Print where uip would read authentication from for the current working directory — the exact diagnostic for "why isn't my session being picked up." Takes no options; it always reports on the walk-up + home-fallback resolution described in Sessions and credentials.

Arguments​

None.

Options​

None.

Examples​

uip login which --output json
uip login which --output json

Data shape — file-based session (--output json)​

{
  "Code": "AuthFile",
  "Data": {
    "Path": "/Users/me/projects/foo/.uipath/.auth",
    "Exists": true,
    "Source": "ancestor"
  }
}
{
  "Code": "AuthFile",
  "Data": {
    "Path": "/Users/me/projects/foo/.uipath/.auth",
    "Exists": true,
    "Source": "ancestor"
  }
}

Source reports where on the walk-up chain the file was found (for example ancestor vs. the home-directory fallback). When the global --profile flag names an active profile, the response also includes a Profile field.

Data shape — environment-variable session (--output json)​

When UIPATH_CLI_ENABLE_ENV_AUTH=true, which reports env-var mode instead of a file:

{
  "Code": "AuthEnv",
  "Data": {
    "EnableVar": "UIPATH_CLI_ENABLE_ENV_AUTH",
    "AllVarsPresent": true,
    "MissingVars": [],
    "Vars": [
      "UIPATH_CLI_AUTH_TOKEN",
      "UIPATH_CLI_ORGANIZATION_NAME",
      "UIPATH_CLI_ORGANIZATION_ID",
      "UIPATH_CLI_TENANT_NAME",
      "UIPATH_CLI_TENANT_ID"
    ]
  }
}
{
  "Code": "AuthEnv",
  "Data": {
    "EnableVar": "UIPATH_CLI_ENABLE_ENV_AUTH",
    "AllVarsPresent": true,
    "MissingVars": [],
    "Vars": [
      "UIPATH_CLI_AUTH_TOKEN",
      "UIPATH_CLI_ORGANIZATION_NAME",
      "UIPATH_CLI_ORGANIZATION_ID",
      "UIPATH_CLI_TENANT_NAME",
      "UIPATH_CLI_TENANT_ID"
    ]
  }
}

MissingVars never includes values — only the names of variables that are unset or empty, so the response is always safe to paste into a ticket or chat.

Failure modes​

  • No credentials file found anywhere on the walk-up chain: AuthenticationError, exit code 2, with instructions to run uip login.
  • The resolved credentials file path exists but isn't usable (for example a directory sits at that path, or file permissions block reading it): Failure, exit code 1 — a host/filesystem problem, not a "log in again" problem.

uip login tenant list​

List all tenants visible to the authenticated user in the current organization. Requires an active login.

Arguments​

None.

Options​

  • -f, --file <folder> — Path to the credentials folder. Defaults to the session used by the last uip login. Mutually exclusive with the global --profile flag.

Example​

uip login tenant list
uip login tenant list

Data shape (--output json)​

{
  "Code": "TenantList",
  "Data": [
    {
      "TenantName": "DefaultTenant",
      "TenantId": "a1b2c3d4-0000-0000-0000-000000000001"
    },
    {
      "TenantName": "ProductionTenant",
      "TenantId": "a1b2c3d4-0000-0000-0000-000000000002"
    }
  ]
}
{
  "Code": "TenantList",
  "Data": [
    {
      "TenantName": "DefaultTenant",
      "TenantId": "a1b2c3d4-0000-0000-0000-000000000001"
    },
    {
      "TenantName": "ProductionTenant",
      "TenantId": "a1b2c3d4-0000-0000-0000-000000000002"
    }
  ]
}

If the session is not logged in, the command emits AuthenticationError with instructions to run uip login first.

uip login tenant set​

Select the active tenant by name. The tenant must exist in the list returned by login tenant list; the CLI updates the stored session with the new selection.

Arguments​

  • <name> (required) — Tenant name as returned by uip login tenant list.

Options​

  • -f, --file <folder> — Path to the credentials folder. Defaults to the session used by the last uip login. Mutually exclusive with the global --profile flag.

Example​

uip login tenant set DefaultTenant
uip login tenant set DefaultTenant

Data shape (--output json)​

{
  "Code": "TenantSet",
  "Data": {
    "Name": "DefaultTenant",
    "Id": "a1b2c3d4-0000-0000-0000-000000000001"
  }
}
{
  "Code": "TenantSet",
  "Data": {
    "Name": "DefaultTenant",
    "Id": "a1b2c3d4-0000-0000-0000-000000000001"
  }
}

Failure modes​

  • Unknown tenant name produces ValidationError with Instructions listing the available tenants, for example argument should be one of DefaultTenant, ProductionTenant.
  • If the CLI cannot update the stored session, the error is surfaced as Failure with a permissions-related hint.

uip login profiles list​

List every named login profile stored under ~/.uipath/profiles (see the global --profile flag), plus the default credentials location.

Options​

  • --all-fields — Also include each profile's authority URL, token expiry, and credentials file path.

Examples​

uip login profiles list
uip login profiles list

{
  "Code": "ProfileList",
  "Data": [
    { "Name": "default", "Active": true, "OrganizationName": "acme", "TenantName": "DefaultTenant", "Status": "Logged in" },
    { "Name": "staging", "Active": false, "OrganizationName": "acme-staging", "TenantName": "QA", "Status": "Expired" }
  ]
}
{
  "Code": "ProfileList",
  "Data": [
    { "Name": "default", "Active": true, "OrganizationName": "acme", "TenantName": "DefaultTenant", "Status": "Logged in" },
    { "Name": "staging", "Active": false, "OrganizationName": "acme-staging", "TenantName": "QA", "Status": "Expired" }
  ]
}

uip login profiles list --all-fields
uip login profiles list --all-fields

Url, ExpiresAt, and Path are included only with --all-fields. In an interactive table, any profile whose Status isn't Logged in is highlighted.

uip login profiles delete​

Delete a named login profile and its stored credentials. This is a real deletion of files on disk — there is no undo.

Arguments​

  • [profile-name] — Name of the profile to delete. Omit when using --all.

Options​

  • --all — Delete every named profile instead of one.
  • -y, --yes — Confirm the deletion. Required — this command never prompts interactively.

Examples​

uip login profiles delete staging --yes
uip login profiles delete staging --yes

{ "Code": "Message", "Data": { "Message": "Deleted profile 'staging'. Removed /home/alice/.uipath/profiles/staging" } }
{ "Code": "Message", "Data": { "Message": "Deleted profile 'staging'. Removed /home/alice/.uipath/profiles/staging" } }

uip login profiles delete --all --yes
uip login profiles delete --all --yes

{
  "Code": "DeleteResult",
  "Data": [
    { "Name": "staging", "Status": "deleted" },
    { "Name": "prod", "Status": "deleted" }
  ]
}
{
  "Code": "DeleteResult",
  "Data": [
    { "Name": "staging", "Status": "deleted" },
    { "Name": "prod", "Status": "deleted" }
  ]
}

Failure modes​

  • Passing both a profile name and --all, or neither, fails with ValidationError before touching disk.
  • default cannot be deleted this way — it fails with ValidationError pointing you at uip logout instead, since default isn't stored under ~/.uipath/profiles.
  • Deleting the profile currently selected by --profile <name> on this same invocation fails with ValidationError (re-run without that flag).
  • With --all, the active profile (if any) is automatically skipped rather than deleted, and reported in the response with Status: "skipped". If skipping it leaves nothing else to delete, the command fails with ValidationError instead of silently succeeding.
  • An unknown profile name fails with Code: "not_found", pointing at login profiles list.

Was this page helpful?

Connect

Need help? Support

Want to learn? UiPath Academy

Have questions? UiPath Forum

Stay updated