UIP 登录

"uip Login" 的语法和选项，用于根据 UiPath Cloud 对 UiPath CLI 进行身份验证，并将会话在本地保留。

uip login针对 UiPath Cloud 对 CLI 进行身份验证，并将生成的会话保留在本地.uipath/文件夹中。成功后，CLI 具有访问令牌和选定的租户；后续命令运行的工具将自动选择这些命令。有关凭据模型，请参阅“身份验证” ；有关文件夹所在的位置，请参阅“会话和凭据” 。

有关检查状态的信息，请参阅uip login status 。要关闭会话，请参阅uip logout 。

大纲

uip login [--tenant <name>] [--organization <name>]
         [--authority <url>] [--client-id <id>] [--client-secret <secret>]
         [--client-assertion <jwt>] [--scope <scopes>] [--no-browser] [-f <folder>]
uip login status
uip login refresh [--login-validity <minutes>]
uip login which
uip login tenant list [-f <folder>]
uip login tenant set <name> [-f <folder>]
uip login profiles list [--all-fields]
uip login profiles delete [profile-name] [--all] -y

Every uip login subcommand honors the global options (--output, --output-filter, --log-level, --log-file, --profile, --interactive/--no-interactive). Exit codes follow the standard contract.

UIP 登录

Authenticates interactively through the browser, or non-interactively using External Application client credentials or a federated (workload-identity) OIDC token.

参数

无。

选项

• -f, --file <folder> — Path to a credentials folder. The session is persisted inside <folder>. Without it, the CLI uses the default location (see Sessions and credentials). Mutually exclusive with the global --profile flag.
• --authority <url> — Custom authority URL, for example https://cloud.uipath.com (default), https://govcloud.uipath.us (Public Sector), or an Automation Suite host. The https:// prefix can be omitted (cloud.uipath.com works).
• --client-id <id> — UiPath 外部应用程序的客户端 ID 或应用程序 ID。接受env.NAME以从环境变量中读取。
• --client-secret <secret> — Client secret for a confidential External Application. Accepts env.NAME to read from an environment variable. Mutually exclusive with --client-assertion.
• --client-assertion <jwt> — OIDC token (JWT) for federated login (workload identity), used instead of a client secret. Accepts env.NAME (recommended) to read from an environment variable — passing the raw token as a literal value prints a warning, since it would otherwise land in shell history, process listings, and CI logs. Requires --client-id. Mutually exclusive with --client-secret.
• -s, --scope <scopes> — Comma- or space-separated scopes (for example, "OR.Folders OR.Jobs"). Use with External Application or federated credentials.
• -t, --tenant <name> — Tenant name (non-interactive mode). If omitted, pair with the global --interactive flag so the CLI can prompt for one.
• --organization <name> — Organization logical name, pre-selected during browser login. Bypasses the org picker when your user is in multiple organizations. Ignored (with a warning) when using client credentials or federated login — the organization is fixed by --client-id in those flows.
• --no-browser — Don't open a browser; print the authorize URL to stderr (prefixed UIPATH_AUTH_URL <url> for automation to grep) and block until the sign-in callback arrives. For headless/automation-driven login. Also settable via UIPATH_CLI_NO_BROWSER=true. Has no effect (and is ignored, with a warning) when using client credentials or federated login — no browser is opened in those flows either way. When a person will do the sign-in, have them run the command in their own terminal — running it through an agent's shell tool hides the printed URL from them.

This page also documents two flags that are not login-specific — see Global options for the full behavior:

• --interactive / --no-interactive — after authentication, force (or suppress) the interactive prompt to select a tenant from the list returned by the cloud. There is no --it short form.
• --profile <name> — use a named, saved login profile instead of the default credentials location. Mutually exclusive with -f, --file.

凭据模式

• 交互式/用户凭据— 运行uip login （可以选择使用--interactive 、 --tenant或--organization ）。浏览器流程在 UiPath Cloud 授权上完成；生成的令牌将保留在凭据文件夹中。
• External Application (client credentials, non-interactive) — pass --client-id, --client-secret, and --scope, typically with --tenant. Suitable for CI runners. Read the secret from an environment variable with --client-secret env.UIPATH_CLIENT_SECRET to keep it out of your shell history.
• Federated / workload identity (non-interactive) — pass --client-id and --client-assertion (an OIDC JWT obtained from your CI provider or workload identity broker in a prior step) instead of a client secret. --client-secret and --client-assertion cannot be combined.

示例

# Browser-based interactive login, picks tenant at the end
uip login --interactive

# Log directly into a known org + tenant (no browser picker)
uip login --organization my-org --tenant DefaultTenant

# Log in to a non-default authority, e.g. an Automation Suite host
uip login --authority automation.acme-corp.com --tenant DefaultTenant

# External Application with secret from environment variable
uip login \
  --client-id "00000000-0000-0000-0000-000000000001" \
  --client-secret env.UIPATH_CLIENT_SECRET \
  --scope "OR.Folders OR.Jobs" \
  --tenant DefaultTenant

# Federated login (workload identity) — the OIDC token comes from your CI provider
uip login \
  --client-id "00000000-0000-0000-0000-000000000001" \
  --client-assertion env.CI_OIDC_TOKEN \
  --tenant DefaultTenant

# Headless / automation-driven login: print the authorize URL instead of opening a browser
uip login --no-browser --tenant DefaultTenant

# Custom credentials folder (useful for scoping per-project sessions)
uip login --interactive -f ./.uipath

数据形状 ( --output json )

{
  "Code": "Authenticated",
  "Data": {
    "Status": "Logged in",
    "Organization": "my-org",
    "Tenant": "DefaultTenant"
  }
}

故障模式

• 非交互式登录后缺少租户会引发包含Message: "No tenant selected"的ConfigError ，并指示您使用--tenant <name>或--interactive重新运行。
• 来自授权机构的传输错误和非 2xx 响应显示为AuthenticationError ，原始 HTTP 状态为Context.httpStatus （如可用）。
• --client-id / --client-secret中格式错误的env.NAME引用会在任何网络调用之前生成ConfigError 。

uip login refresh

Proactively refresh the access token and emit a machine-readable session payload (access token, org/tenant identity, expiration). Intended for programmatic consumers (for example an IDE extension) that need a guaranteed-valid token for the next few minutes — unlike uip login status, which is a status report and only rotates the token incidentally when it has already expired, refresh forces a rotation ahead of time when needed.

参数

无。

选项

• --login-validity <minutes> — refresh only if the current access token expires within this many minutes. Default 5. Pass 0 to skip the proactive check and only rotate if the token is already expired. Range 0–525600 (one year).

示例

# Refresh and print a token guaranteed valid for the next 5 minutes (the default)
uip login refresh --output json

# Require at least 10 minutes of validity, forcing a refresh if the token expires sooner
uip login refresh --login-validity 10 --output json

数据形状 ( --output json )

{
  "Code": "LoginRefresh",
  "Data": {
    "Status": "Logged in",
    "Organization": "my-org",
    "Tenant": "DefaultTenant",
    "Expiration Date": "2026-04-18T10:30:00Z",
    "BaseUrl": "https://cloud.uipath.com",
    "OrganizationId": "00000000-0000-0000-0000-000000000001",
    "OrganizationName": "my-org",
    "TenantId": "00000000-0000-0000-0000-000000000002",
    "TenantName": "DefaultTenant",
    "AccessToken": "<jwt>"
  }
}

重要提示：

AccessToken is only included when --output json is in effect and either --output was passed explicitly or stdout is non-interactive (piped/redirected). A bare, interactive uip login refresh in a terminal never prints the token — this is deliberate, so the token doesn't land in scrollback by accident. Code is LoginRefreshPartial instead of LoginRefresh when the refreshed token could not be persisted back to disk (the caller still gets a valid, usable token for the current process).

故障模式

• Not logged in, refresh failed, or the token expired with no refresh token available: AuthenticationError, exit code 2, with Instructions naming the specific cause.

uip login which

Print where uip would read authentication from for the current working directory — the exact diagnostic for "why isn't my session being picked up." Takes no options; it always reports on the walk-up + home-fallback resolution described in Sessions and credentials.

参数

无。

选项

无。

示例

uip login which --output json

Data shape — file-based session (--output json)

{
  "Code": "AuthFile",
  "Data": {
    "Path": "/Users/me/projects/foo/.uipath/.auth",
    "Exists": true,
    "Source": "ancestor"
  }
}

Source reports where on the walk-up chain the file was found (for example ancestor vs. the home-directory fallback). When the global --profile flag names an active profile, the response also includes a Profile field.

Data shape — environment-variable session (--output json)

When UIPATH_CLI_ENABLE_ENV_AUTH=true, which reports env-var mode instead of a file:

{
  "Code": "AuthEnv",
  "Data": {
    "EnableVar": "UIPATH_CLI_ENABLE_ENV_AUTH",
    "AllVarsPresent": true,
    "MissingVars": [],
    "Vars": [
      "UIPATH_CLI_AUTH_TOKEN",
      "UIPATH_CLI_ORGANIZATION_NAME",
      "UIPATH_CLI_ORGANIZATION_ID",
      "UIPATH_CLI_TENANT_NAME",
      "UIPATH_CLI_TENANT_ID"
    ]
  }
}

MissingVars never includes values — only the names of variables that are unset or empty, so the response is always safe to paste into a ticket or chat.

故障模式

• No credentials file found anywhere on the walk-up chain: AuthenticationError, exit code 2, with instructions to run uip login.
• The resolved credentials file path exists but isn't usable (for example a directory sits at that path, or file permissions block reading it): Failure, exit code 1 — a host/filesystem problem, not a "log in again" problem.

UIP 登录租户列表

列出当前组织中对身份验证用户可见的所有租户。需要有效登录。

参数

无。

选项

• -f, --file <folder> — Path to the credentials folder. Defaults to the session used by the last uip login. Mutually exclusive with the global --profile flag.

示例

uip login tenant list

数据形状 ( --output json )

{
  "Code": "TenantList",
  "Data": [
    {
      "TenantName": "DefaultTenant",
      "TenantId": "a1b2c3d4-0000-0000-0000-000000000001"
    },
    {
      "TenantName": "ProductionTenant",
      "TenantId": "a1b2c3d4-0000-0000-0000-000000000002"
    }
  ]
}

如果会话未登录，该命令会发出AuthenticationError其中包含先运行uip login说明。

UIP 登录租户集

按名称选择活动租户。租户必须存在于login tenant list返回的列表中； CLI 使用新选择来更新存储的会话。

参数

• <name> （必填） — uip login tenant list返回的租户名称。

选项

• -f, --file <folder> — Path to the credentials folder. Defaults to the session used by the last uip login. Mutually exclusive with the global --profile flag.

示例

uip login tenant set DefaultTenant

数据形状 ( --output json )

{
  "Code": "TenantSet",
  "Data": {
    "Name": "DefaultTenant",
    "Id": "a1b2c3d4-0000-0000-0000-000000000001"
  }
}

故障模式

• 未知租户名称时会生成ValidationError其中Instructions会列出可用的租户，例如argument should be one of DefaultTenant, ProductionTenant 。
• 如果 CLI 无法更新存储的会话，错误将显示为Failure ，并带有与权限相关的提示。

uip login profiles list

List every named login profile stored under ~/.uipath/profiles (see the global --profile flag), plus the default credentials location.

选项

• --all-fields — Also include each profile's authority URL, token expiry, and credentials file path.

示例

uip login profiles list

{
  "Code": "ProfileList",
  "Data": [
    { "Name": "default", "Active": true, "OrganizationName": "acme", "TenantName": "DefaultTenant", "Status": "Logged in" },
    { "Name": "staging", "Active": false, "OrganizationName": "acme-staging", "TenantName": "QA", "Status": "Expired" }
  ]
}

uip login profiles list --all-fields

Url, ExpiresAt, and Path are included only with --all-fields. In an interactive table, any profile whose Status isn't Logged in is highlighted.

uip login profiles delete

Delete a named login profile and its stored credentials. This is a real deletion of files on disk — there is no undo.

参数

• [profile-name] — Name of the profile to delete. Omit when using --all.

选项

• --all — Delete every named profile instead of one.
• -y, --yes — Confirm the deletion. Required — this command never prompts interactively.

示例

uip login profiles delete staging --yes

{ "Code": "Message", "Data": { "Message": "Deleted profile 'staging'. Removed /home/alice/.uipath/profiles/staging" } }

uip login profiles delete --all --yes

{
  "Code": "DeleteResult",
  "Data": [
    { "Name": "staging", "Status": "deleted" },
    { "Name": "prod", "Status": "deleted" }
  ]
}

故障模式

• Passing both a profile name and --all, or neither, fails with ValidationError before touching disk.
• default cannot be deleted this way — it fails with ValidationError pointing you at uip logout instead, since default isn't stored under ~/.uipath/profiles.
• Deleting the profile currently selected by --profile <name> on this same invocation fails with ValidationError (re-run without that flag).
• With --all, the active profile (if any) is automatically skipped rather than deleted, and reported in the response with Status: "skipped". If skipping it leaves nothing else to delete, the command fails with ValidationError instead of silently succeeding.
• An unknown profile name fails with Code: "not_found", pointing at login profiles list.

相关内容

• uip login status — 显示当前会话而不刷新。
• uip logout — 清除存储的会话。
• 身份验证— 用户与外部应用程序流程。
• 会话和凭据— 凭据文件夹的定位和轮换方式。
• 配置— 凭据来源（环境变量、文件、标志）的优先级。