# Authentication flow

> Authentication flow - Reusable authentication mechanism for DataRobot CLI commands.

This Markdown file sits beside the HTML page at the same path (with a `.md` suffix). It summarizes the topic and lists links for tools and LLM context.

Companion generated at `2026-05-06T18:17:09.548907+00:00` (UTC).

## Primary page

- [Authentication flow](https://docs.datarobot.com/en/docs/agentic-ai/cli/development/authentication.html): Full documentation for this topic (HTML).

## Sections on this page

- [Overview](https://docs.datarobot.com/en/docs/agentic-ai/cli/development/authentication.html#overview): In-page section heading.
- [Using authentication in commands](https://docs.datarobot.com/en/docs/agentic-ai/cli/development/authentication.html#using-authentication-in-commands): In-page section heading.
- [PreRunE hook (recommended)](https://docs.datarobot.com/en/docs/agentic-ai/cli/development/authentication.html#prerune-hook-recommended): In-page section heading.
- [How it works](https://docs.datarobot.com/en/docs/agentic-ai/cli/development/authentication.html#how-it-works): In-page section heading.
- [Direct call (for non-command code)](https://docs.datarobot.com/en/docs/agentic-ai/cli/development/authentication.html#direct-call-for-non-command-code): In-page section heading.
- [When to use](https://docs.datarobot.com/en/docs/agentic-ai/cli/development/authentication.html#when-to-use-authentication): In-page section heading.
- [Commands with authentication](https://docs.datarobot.com/en/docs/agentic-ai/cli/development/authentication.html#commands-with-authentication): In-page section heading.
- [Skipping authentication](https://docs.datarobot.com/en/docs/agentic-ai/cli/development/authentication.html#skipping-authentication): In-page section heading.
- [Using the skip-auth flag](https://docs.datarobot.com/en/docs/agentic-ai/cli/development/authentication.html#using-the-skip-auth-flag): In-page section heading.
- [Behavior](https://docs.datarobot.com/en/docs/agentic-ai/cli/development/authentication.html#behavior): In-page section heading.
- [When to use skip-auth](https://docs.datarobot.com/en/docs/agentic-ai/cli/development/authentication.html#when-to-use-skip-auth): In-page section heading.
- [Manual login](https://docs.datarobot.com/en/docs/agentic-ai/cli/development/authentication.html#manual-login): In-page section heading.

## Related documentation

- [Agentic AI](https://docs.datarobot.com/en/docs/agentic-ai/index.html): Linked from this page.
- [CLI](https://docs.datarobot.com/en/docs/agentic-ai/cli/index.html): Linked from this page.

## Documentation content

## Overview

The CLI provides a reusable authentication mechanism that you can use with any command that requires valid DataRobot credentials. Authentication is handled using Cobra's `PreRunE` hooks, which ensure credentials are valid before a command executes.

## Using authentication in commands

### PreRunE hook (recommended)

The recommended approach is to use the `auth.EnsureAuthenticatedE()` function in your command's `PreRunE` hook:

```
import "github.com/datarobot/cli/cmd/auth"

var MyCmd = &cobra.Command{
    Use:   "mycommand",
    Short: "My command description",
    PreRunE: func(_ *cobra.Command, _ []string) error {
        return auth.EnsureAuthenticatedE()
    },
    Run: func(_ *cobra.Command, _ []string) {
        // Command implementation
        // Authentication is guaranteed to be valid here
    },
}
```

### How it works

1. Checks for valid credentials —first checks if a valid API key already exists.
2. Auto-configures URL if missing —if no DataRobot URL is configured, prompts you to set it up.
3. Retrieves new credentials —if credentials are missing or expired, automatically triggers the browser-based login flow.
4. Fails early —if authentication cannot be established, the command won't run and returns an error.

### Direct call (for non-command code)

For code that isn't a Cobra command, you can use `auth.EnsureAuthenticated()` directly:

```
import "github.com/datarobot/cli/cmd/auth"

func MyFunction() error {
    // Ensure valid authentication before proceeding.
    if !auth.EnsureAuthenticated() {
        return errors.New("authentication failed")
    }

    // Continue with authenticated operations.
    apiKey := config.GetAPIKey()
    // ... use apiKey for API calls

    return nil
}
```

### When to use

Add authentication to any command that:

- Makes API calls to DataRobot endpoints.
- Needs to populate DataRobot credentials in configuration files.
- Requires valid authentication to function correctly.

### Commands with authentication

The following commands use `PreRunE` to ensure authentication:

- dr dotenv update —automatically ensures authentication before updating environment variables.
- dr templates list —requires authentication to fetch templates from the API.
- dr templates clone —requires authentication to fetch template details.

## Skipping authentication

For advanced use cases where authentication is handled externally or not required, you can bypass authentication checks using the `--skip-auth` global flag.

### Using the skip-auth flag

```
# Skip authentication for any command
dr templates list --skip-auth
dr dotenv update --skip-auth

# Skip authentication with environment variable
DATAROBOT_CLI_SKIP_AUTH=true dr templates setup
```

### Behavior

When `--skip-auth` is enabled:

1. Bypasses all authentication checks —the EnsureAuthenticated() function returns true immediately without validating credentials.
2. Emits a warning —logs a warning message: "Authentication checks are disabled via --skip-auth flag. This may cause API calls to fail."
3. May cause API failures —commands that make API calls will likely fail if no valid credentials are present.

### When to use skip-auth

The `--skip-auth` flag is intended for advanced scenarios such as:

- Testing —testing command logic without requiring valid credentials.
- CI/CD pipelines —when authentication is managed through environment variables ( DATAROBOT_API_TOKEN ).
- Offline development —working in environments without internet access or access to DataRobot.
- Debugging —isolating authentication issues from other command behavior.

> ⚠️ Warning:This flag should only be used when you understand the implications. Most users should rely on the standard authentication flow viadr auth login.

## Manual login

You can still manually run `dr auth login` to refresh credentials or change accounts. The `LoginAction()` function provides the interactive login experience with confirmation prompts for overwriting existing credentials.