Authenticating Meshery via CLI

mesheryctl needs a token to call Meshery Server on your behalf. Run mesheryctl system login to get one. Meshery Server must be running first, so start it with mesheryctl system start if it is not.

Log in from a machine with a browser

Run the login command:
```
mesheryctl system login
```
mesheryctl asks Meshery Server which providers it offers and prompts you to pick one:
```
Use the arrow keys to navigate: ↓ ↑ → ←
? Select a Provider:
  ▸ Meshery
    Local
```
The list comes from your server, so it shows any additional remote providers your server is configured with. To skip the prompt, name the provider with -p, for example mesheryctl system login -p Meshery. Run mesheryctl system provider list to see the names.
Choose a provider:
- Meshery (or another remote provider) opens your browser at the provider’s sign-in page. After you sign in, the page says “you have logged in, you can close this window now”. Close it and return to your terminal. A remote provider keeps your designs, environments, and performance results between sessions.
- Local signs you in without a browser. Your work stays on this Meshery Server only.
Confirm that mesheryctl printed authenticated and that it saved the token to ~/.meshery/auth.json:
```
ls -l ~/.meshery/
```
```
-rw-rw-r-- 1 ubuntu ubuntu  39 Dec 21 06:13 auth.json
-rw-rw-r-- 1 ubuntu ubuntu 260 Dec 21 06:04 config.yaml
-rw-rw-r-- 1 ubuntu ubuntu 988 Dec 21 06:04 meshery.yaml
```
mesheryctl writes the token to the file that the current context’s token entry points to in ~/.meshery/config.yaml. That file is ~/.meshery/auth.json unless you changed it with mesheryctl system token.

Log in from a machine without a browser

If mesheryctl runs on a machine with no browser, such as a remote server or a CI runner, download a token from Meshery Cloud and copy it onto that machine.

Go to https://cloud.meshery.io/security/tokens and sign in. Check that you are in the right organization, then click Create.
Enter a token name and purpose, then click Create.
Click the Download icon to download the token as auth.json.
Copy auth.json to ~/.meshery/auth.json on the machine that runs mesheryctl. To keep the file somewhere else, register its path as a token and attach it to your context:
```
mesheryctl system token create my-token -f /path/to/auth.json --set
```
Run mesheryctl system check and confirm that it reports no authentication error.