Authentication
Choose credentials for the task you are doing. Browser sign-in, API access, and SSH connections use different mechanisms.
Choose an authentication method
| Your task | Use |
|---|---|
| Sign in to the ACTIVATE website | Your organization's configured sign-in method, such as a password with MFA or SSO. |
| Use the CLI | Browser sign-in with pw auth, or pw auth --device from a remote terminal. The CLI renews access while the sign-in remains valid. |
| Use an SDK in a notebook or script | Your saved CLI sign-in. Create the client from credential config to let the SDK handle OAuth access tokens and renewal automatically. |
| Run CI, cron, or a persistent unattended service | An API key, with an expiration suited to the task and a rotation plan for work that needs to continue. |
| Connect from your computer to a cluster over SSH | Register your public SSH key; keep its private key on your computer. |
| Let ACTIVATE connect to an existing remote resource | Store an SSH private key that the remote resource accepts. |
After you sign in with pw auth, the Go, Python, and TypeScript SDKs can use that sign-in through their credential-config constructors. The SDK obtains OAuth access tokens, includes them in requests, and renews them automatically through the CLI. You do not need to copy tokens or write refresh logic. Keep pw installed and available to the script; if the sign-in expires or is revoked, sign in again.
For command-line API calls, pw api handles authentication too. Use pw auth token --print only when another tool needs a bearer token. See Authentication for CLI and scripts for long-running scripts, token lifetimes, and isolated credential directories.
Managing API Keys
Use an API key for scheduled scripts, CI, and other automation that must run without you signing in again, through the REST API, the SDKs, or the CLI with PW_API_KEY. To use the CLI yourself, on your own computer or a cluster, sign in with pw auth instead.
The Token option in the Create menu creates the same kind of API key with a short expiration. Both options produce keys that appear in the API keys list and can be revoked there.
Note
Please note that API keys act as an alternate means to access your account and should be treated with the same care as your login password.
Create an API Key
Navigate to your account settings (Username > Account).
On the next page, click Authentication.
Scroll to the API keys section.
Click Create and choose API key.
Enter a Key name for the new API key.
Use the Expires dropdown menu to select when your key will expire. By default, the expiration you choose must be within 730 days. Your organization or platform admin can set a different limit with the Maximum API Key TTL policy, and keys that never expire are offered only when that policy is Unlimited. Choose an expiration appropriate to the job and rotate the key before it expires. Keys do not renew automatically.
Click Create.
Your new API key is displayed in a banner above the key list. You can use the copy button to copy and save the key in a secure place. Once you refresh or navigate away from this page, you won’t be able to see the key again.
Delete an API Key
Navigate to Account > Authentication, hover over the key's row in the API keys section, open its … menu, and click Delete to remove an API key from your ACTIVATE account.
A dialog box will appear with more information about deleting your key. Click Delete API Key to confirm the deletion. The key will be removed from your account immediately.
Short-lived API keys
For a quick script or a one-off API call, choose the Token option to create an API key lasting 1–24 hours. Like any API key, it does not renew, even if you save it with pw auth or pass it to an SDK. Replace it before expiration if the work needs to continue.
OAuth access tokens are different: after browser or device sign-in, pw auth token --print prints a short-lived access token that the CLI can replace using your saved sign-in. The printed value alone does not carry that renewal ability.
You do not need to create an API key for scripts you run on a signed-in computer. Call pw api, use an SDK created from credential config, or follow the curl example.
Create a short-lived API key
Navigate to Account > Authentication. In the API keys section, click Create and choose Token.
Use the Expires dropdown menu to choose how long the key lasts, from 1 to 24 hours, and click Generate. You can also create one from the command palette with Create Token.
Your new API key is displayed in a banner above the key list. Use the copy button to save it in a secure place; once you refresh or navigate away, you won't be able to see the value again. The key appears in the API keys list with a generated name starting with token-. To revoke it before it expires, delete it like any other key.
Managing SSH Keys
You can add an SSH key to your ACTIVATE account, which will allow you to log in to any active cluster from any device with that SSH key on it.
Create an SSH Key
Navigate to your account settings (Username > Account).
On the next page, click Authentication.
Scroll to the SSH keys section.
Click Add.
Use the Key name field to give the key a unique name. Paste your public SSH key in the Public key field.
Click Create.
You can now log in to any active cluster. Navigate to the terminal or command line on your device and enter ssh -i /path/to/ssh/private/key username@IPaddress:
parallelworks@Parallels-Macbook-Air sshtest % ssh -i ./id_rsa demo@34.135.24.147
Last failed login: Thu Mar 2 09:48:20 UTC 2023 from 60.94.197.104.bc.googleusercontent.com on ssh:notty
[demo@democluster-70 ~]$
Copy an SSH Key
In Account > Authentication, hover over the key's row in the SSH keys section and click the clipboard icon to copy your SSH key to your computer's clipboard.
Managing SSH Private Keys
You can store private SSH keys on your ACTIVATE account, which the platform uses on your behalf to connect to remote resources — for example, existing clusters that require an SSH credential you already hold.
Unlike the public SSH keys described above (which let you log in to your clusters), private keys let ACTIVATE log in from the platform to a remote resource.
Create an SSH Private Key
Navigate to your account settings (Username > Account). On the next page, click Authentication and scroll to the SSH private keys section.
Click Add.
Use the Key name field to give the key a unique name, and optionally add a Description. Paste your private key in the Private key field.
Click Create. The key is then listed with its description, creation date, and fingerprint.
Delete an SSH Private Key
In Account > Authentication, hover over the key's row in the SSH private keys section, open its … menu, and click Delete . A dialog box will appear; click Delete private key to confirm.
Managing Multi-Factor Authentication
You can add a second verification step to your account. With 2-Step Verification turned on, signing in requires a code from an authenticator app in addition to your password.
Turn On 2-Step Verification
Navigate to your account settings (Username > Account). On the next page, click Authentication.
In the Sign-in section, the Two-step verification row shows whether 2-Step Verification is currently on or off. Click Set up.
On the Manage MFA Settings page, find the Authenticator app card and click Use Authenticator.
On the Setup Authenticator App page, use a phone app like 1Password, Authy, Google Authenticator, or Microsoft Authenticator to scan the QR code. If you can't scan the QR code, click Can't scan the QR code? to reveal a secret key you can enter in your app manually.
Enter the 6-digit code from your app in the Verification code field and click Enable 2FA. A dialog box with the message MFA setup successful will appear.
The next time you sign in, you'll be asked for a code from your authenticator app after entering your password.
Feature Preview
Security keys (WebAuthn) are also available as an MFA method through a Feature Preview. Organizations can require them with the Enforce Security Key MFA policy.
Turn Off 2-Step Verification
Navigate to Account > Authentication and click Manage on the Two-step verification row.
To remove your authenticator app, click the delete icon on its card. A dialog box will appear; click Remove Authenticator app to confirm. Your authenticator will be removed immediately.
To turn off 2-Step Verification entirely, click Turn Off. A dialog box will appear; click Turn off 2-Step Verification to confirm.