CLI application authentication

authentik: 2025.12.0+

The authentik Agent can authenticate to CLI applications such as aws and kubectl.

How CLI authentication works

First, authentik-agent and authentik-cli request an authentik token from the authentik-cli OAuth Provider and exchange it for a token from the specified Kubernetes or AWS provider.

This token is cached until expiration. This improves performance by eliminating repeated token requests.

More information

For more information, refer to each of the topics below:

📄️AWS

You can use the authentik Agent to authenticate to the AWS CLI with authentik credentials.

📄️Kubernetes

You can use the authentik Agent to authenticate to kubectl with authentik credentials.