Authentication

Authenticate with the Nullify CLI using browser-based login or API tokens

Interactive Login

For interactive usage, the CLI opens your browser to authenticate directly with your identity provider:

nullify auth login --host 'api.<TENANT>.nullify.ai'

This will:

1. Open your browser to authenticate with a sign-in provider enabled for your workspace

2. Redirect back to the CLI automatically once authenticated

3. Store the host in ~/.nullify/config.json and the tokens in ~/.nullify/credentials.json

Auth Commands

Check login status

nullify auth status

View current token

nullify auth token

Switch between hosts

nullify auth switch --host 'api.<OTHER-TENANT>.nullify.ai'

Log out

nullify auth logout

View configuration

nullify auth config

CI/CD Usage

For non-interactive environments (CI/CD pipelines, scripts), use token-based authentication:

Using a Nullify API Token

nullify --nullify-token '<TOKEN>' findings --type sast

Or set via environment variable:

export NULLIFY_TOKEN='<TOKEN>'
nullify findings --type sast

Using a GitHub Token

Inside a GitHub Actions workflow, pass the workflow's GitHub token with --github-token. The CLI exchanges it for a Nullify token:

nullify --github-token ${{ secrets.GITHUB_TOKEN }} findings --type sast

The GitHub token exchange only triggers when the CLI is running inside GitHub Actions — specifically when GITHUB_ACTIONS=true and GITHUB_REPOSITORY is set (both are provided automatically by the Actions runner). The token value itself must be supplied via the --github-token flag. The CLI does not independently read a bare GITHUB_TOKEN environment variable as a credential source.

Token Precedence

The CLI resolves authentication in this order:

1. --nullify-token flag

2. NULLIFY_TOKEN environment variable

3. --github-token flag, exchanged for a Nullify token — only when GITHUB_ACTIONS=true and GITHUB_REPOSITORY is set

4. Stored credentials from nullify auth login

Credential Storage

nullify auth login writes two files under ~/.nullify/:

• config.json — stores the host you logged in to ({"host": "..."}), used to resolve the default Nullify instance for subsequent commands.

• credentials.json — a per-host map of credentials (keyed by host), each entry containing access_token, refresh_token, expires_at, and any query_parameters returned at login. Written with file permissions 0600 (owner read/write only).

Tokens are automatically refreshed using the stored refresh token when they expire.

For Microsoft Entra sign-in, the directory and your activated member identity must already be connected. A CLI login does not create workspace access. Entra-only sign-in, deactivation, role changes and network admission also apply to human CLI requests; a stored token does not bypass them. Service-account and GitHub Actions authentication are separate automation flows.

Browser callback troubleshooting

Interactive login starts a temporary HTTP listener on 127.0.0.1 using an available port and waits up to ten minutes. If the browser does not open, use the login URL printed in the terminal. Complete login on the same machine as the CLI so the callback reaches that listener. A browser on your laptop cannot automatically reach a callback listener inside an unrelated remote server or container; use token authentication for those environments.

Service-account tokens have different lifetime and revocation behavior from interactive credentials. Read API Authentication before choosing a role or rotating a service account. Avoid printing auth token output into CI logs.