Skip to main content
Enterprise SSO requires User Provisioning to be configured, and the signed-in user needs an access profile or assigned virtual key. If you have not installed the CLI yet, see Install the CLI.

​
Set up the CLI

1

Add a context

2

Sign in with Enterprise SSO

The CLI opens your browser to the Bifrost sign-in page, which uses your organization’s identity provider. When sign-in completes, the terminal prints:
followed by the number of assigned virtual keys available to you.If the browser cannot open, run bifrost auth login --no-browser and open the printed URL on the same machine. The sign-in callback listens on a local 127.0.0.1 port, so the flow cannot be completed from another device.
3

Choose an assigned virtual key (optional)

By default, the gateway applies your access profile or a default assigned key. To pin one of your assigned keys for this context:
bifrost auth clear-selection returns to the gateway default. An administrator can require a specific key, in which case only that key can be selected.
4

Add a management API key (administrators)

Skip this step if you only use the CLI for inference and coding agents.
  1. In the Bifrost dashboard, go to Settings → API Keys and select Create API Key.
  2. Choose scopes for the resources and operations the key needs. Setting an expiry is optional but recommended.
  3. Copy the bfst-* key. It is shown only once.
  4. Store it in the context:
bifrost auth whoami lists the permissions the key holds.
5

Verify

In auth status, confirm inference_credential_type is enterprise-sso and, for administrators, management_credential_type is management-api-key.

​
Management API key permissions

A management API key has only the permissions in its scopes; it does not inherit the creating user’s role. You can grant only scopes you hold yourself, and a request outside the key’s scopes fails with exit code 3. Grant the least access each workflow needs. Scopes are named by dashboard resource and operation, for example:

​
Session lifetime

An SSO access token is valid for one hour and refreshes automatically with a refresh token that is valid for 30 days and rotates on each use. If the refresh token expires or is revoked, commands fail with exit code 3; run bifrost auth login again. bifrost auth logout revokes the session and removes the stored SSO and dashboard session credentials from the context.

​
Next steps

Coding agents

Launch Claude Code, Codex, OpenCode, or Gemini through Bifrost.

Contexts and credentials

Work across environments and configure CI.

Commands

Inspect, query, and administer the gateway.

User Provisioning

Connect your identity provider for Enterprise SSO.