**Source URL:** https://limited.veevavault.dev/medical/vault-dx/cli/getting-started/authentication

# Authentication

The CLI supports two authentication mechanisms. Browser SSO is the default for interactive use. API access tokens are the primary mechanism for headless and CI/CD use.

## Browser (SSO)

Running `vault login` opens a browser window against `login.veevavault.com`. Works with both SSO and standard Vault users.

```sh
vault login --vault myorg.veevavault.com
```

The browser window closes after a successful login. Credentials are stored locally under `~/.vault/` for subsequent commands.

## API Access Token

Pass `--access-token` on any vault-facing command. No prior `vault login` is required.

To store the token for subsequent commands:

```sh
vault login --vault myorg.veevavault.com --access-token veeva-vault-abc123
```

To authenticate a single command without storing credentials:

```sh
vault query "SELECT id__v FROM documents__v" \
  --access-token veeva-vault-abc123 \
  --env myorg.veevavault.com
```

## Session ID

Pass a pre-existing Vault API session token with `--session-id`:

```sh
vault login --vault myorg.veevavault.com --session-id <SESSION_ID>
```

## Username & Password

Basic authentication uses your Vault username and password directly. The CLI never persists the password. Only the resulting session token is stored.

```sh
vault login --vault myorg.veevavault.com --username user@example.com --password <PASSWORD>
```

## CI/CD (headless)

In non-interactive environments, pass `--access-token` directly on each command. Use `--env` to specify the target vault:

```sh
vault config pull --env myorg.veevavault.com --access-token $VAULT_TOKEN
vault config push --env myorg.veevavault.com --access-token $VAULT_TOKEN --force
```

## Manage stored credentials

To list stored credentials:

```sh
vault login creds list
```

To remove stored credentials:

```sh
vault logout
```

See the [`vault login` reference](/medical/vault-dx/dx-reference/command-reference/login/) for the full credential management surface.

---

**Previous:** [Installation](/medical/vault-dx/cli/getting-started/installation)  
**Next:** [Managing Configuration as Code](/medical/vault-dx/cli/getting-started/managing-configuration-as-code)