How you authenticate depends on where the CLI is running.
On your own machine, run iris auth login and sign in through the browser.
On a CI runner, set IRIS_LICENCE_TOKEN as a secret instead. The CLI reads it directly, so there is no login step in the pipeline.
The commands
iris auth login is interactive: it asks whether you want to sign in through the browser or paste a token. It requires a terminal, and reports an error rather than hanging when it does not have one.
How credentials are stored
Both the browser flow and the manual token entry write to ~/.iris/credentials. The file is created with chmod 600 so only the current user can read it.
Add ~/.iris/ to your global gitignore to prevent accidentally committing credentials to a repository.
Priority order
The CLI resolves credentials in this order:
IRIS_LICENCE_TOKEN environment variable - checked first; takes precedence over the credentials file- Credentials file at
~/.iris/credentials - written by iris auth login, whichever method (browser or manual token) you choose at the prompt
Using IRIS_LICENCE_TOKEN in CI
The environment variable is the recommended approach for CI runners. It avoids writing any files to the runner filesystem and is revoked simply by rotating the secret in your repository settings.
To use the token in a CI pipeline:
- Add your licence key as a repository secret named
IRIS_LICENCE_TOKEN in your CI provider settings.
- Reference the secret as the
IRIS_LICENCE_TOKEN environment variable in the workflow step that runs Iris Code.
- The CLI reads the env var automatically - no
iris auth login step is required on the runner.
iris secrets and iris security run without any authentication at all - both are free and require no licence. You can use either in any pipeline without setting IRIS_LICENCE_TOKEN.
