Install and sign in to the CLI

The Tenvyr CLI obtains governed credentials and then launches your operating system’s OpenSSH client.

Requirements

• a supported 64-bit Linux, macOS, or Windows workstation;
• the current pilot CLI package and verified checksum;
• OpenSSH client tools available on PATH; and
• a Tenvyr account with MFA.

Sign in

tenvyr login --tenant YOUR_TENANT_UUID

The CLI prints a verification URL and code. Open the URL, sign in, verify the code belongs to your terminal, and approve the device. The CLI polls until it receives a 15-minute scoped token.

Credentials are stored in an owner-only, no-follow path on Unix and a protected non-reparse local-drive path on Windows.

Check the workstation

tenvyr doctor
tenvyr version

doctor checks API reachability and the local OpenSSH environment. Resolve any failure before requesting production access.

Sign out

tenvyr logout

This revokes the current server-side token and clears the local credential.

Development-only token input

--token-stdin and --token-file exist for controlled diagnostics. They are not the normal production login path. Never place a token in a process argument.