CLI command for workload authentication

Use the Okta Privileged Access client CLI for autonomous, non-interactive operations. Workloads authenticate and retrieve a temporary access token by running the sft workload authenticate command (aliased as sft wl auth), which is essential for automation scripts and CI/CD pipelines that can't rely on human intervention. You can authenticate using either JWT-based credentials or API keys, depending on your workload connection type.

Before you begin

You have DevOps admin or DevOps engineer role.
For JWT authentication: You have an identity token from your workload provider and it's set as an environment variable.
For API key authentication: A security admin has generated an API key for the workload connection and delivered it to you through a secure channel. See Generate, rotate, and revoke API keys for details on how security admins create API keys.

Example use of JWT workload authentication

Because sft workload authentication is non-interactive, you can export its token as an environment variable (OPA_TOKEN) for use in scripts.

Set OPA_ADDR and SFT_TEAM in an environment variable.


export OPA_ADDR=<URL>
export SFT_TEAM=<my-team>

Run the following command to configure your SSH settings for workload authentication.

sft ssh-config >> ~/.ssh/config

After completing this step, native SSH and SCP commands will automatically route through the SFT proxy without requiring the sft ssh wrapper. For example, scp <local-file> <hostname>:/remote/path.

Run the following command to get the OPA_TOKEN.

OPA_TOKEN=$(sft wl authenticate \
--team <my-team> \
--connection <workload-connection-name> \
--jwt-env <my-jwtnnnenv> \
--role-hint <workload-role-name>)

Execute the following command to test the configuration.

sft ssh myhost --command "echo hello"

Example use of API key workload authentication

For workload connections configured with API key authentication, you use the API key directly instead of a JWT. The security admin provides the API key out-of-band to the DevOps engineer.

Set OPA_ADDR and SFT_TEAM in environment variables.


export OPA_ADDR=<URL>
export SFT_TEAM=<my-team>

Set the API key as an environment variable.
```
export OPA_API_KEY_PROD=<your-api-key>
               
```
Note:
The API key is revealed only once at creation and includes the opakey_ prefix. Store it securely and treat it with the same care as a password. If the key is lost, request a new one from the security admin.
Run the following command to get the OPA_TOKEN.
```
export OPA_TOKEN=$(sft wl authenticate \
--team <my-team> \
--connection <workload-connection-name> \
--role-hint <workload-role-name>)		
```
Note:
When you use API key authentication, the --jwt-env flag isn't required. The command automatically uses the OPA_API_KEY_PROD environment variable that you set in the previous step.
Execute the following command to test the configuration.

sft ssh myhost --command "echo hello"