rayfin login
Sign in to Rayfin for Fabric operations, inspect status, sign out, and understand token cache storage.
Fabric operations such as rayfin dev, rayfin up, rayfin secret, and connector
inspection need a signed-in identity. Commands prompt for login when needed, but sign in
explicitly when you need a tenant, a service principal, or a status check.
login
npx rayfin loginOpens the Microsoft Entra ID account picker.
| Option | Default | Description |
|---|---|---|
-t, --tenant <id> | account home tenant | Tenant ID for Fabric sign-in. |
--service-principal | false | Authenticate to Fabric with client credentials. |
-u, --client-id <id> | — | Client ID for service principal auth. |
-p, --client-secret <secret> | — | Client secret for service principal auth. |
--select | no effect | Deprecated; the MSAL account picker is always shown. |
--encryption-fallback-enabled | false | Allow plaintext token storage when the OS keychain is unavailable. |
Service principal sign-in
npx rayfin login --service-principal --client-id <id> --client-secret <secret> --tenant <tenant-id>Use this for CI. Store client ID, client secret, and tenant ID in your CI secret store.
Validation rules are strict:
--service-principalrequires--client-id,--client-secret, and--tenant.- Passing
--client-idor--client-secretwithout--service-principalis rejected so the CLI does not silently choose the wrong auth flow. - If
RAYFIN_TOKENis set, login is managed externally andrayfin loginskips cached sign-in.
Ambient token
If a bearer token is already available, set RAYFIN_TOKEN in the shell instead of running
rayfin login. This bypasses CLI login state for the process. For CI, prefer service
principal login unless another trusted system already minted the token.
login status
npx rayfin login statusDisplays the current authentication status.
logout
npx rayfin logoutClears cached credentials and account hints.
Auth state files
| Path | Contents |
|---|---|
~\.rayfin\auth.json | Signed-in account, tenant hints, service-principal metadata, and persisted environment overrides. |
~\.rayfin\cache.bin | MSAL token cache, encrypted with the OS keychain when available. |
Set RAYFIN_CONFIG_DIR to relocate ~\.rayfin.
Warning
Use --encryption-fallback-enabled or RAYFIN_ENCRYPTION_FALLBACK_ENABLED=true only
after a keychain error. It permits plaintext token cache storage.
Add a CI step that runs `npx rayfin login --service-principal --client-id $CLIENT_ID
--client-secret $CLIENT_SECRET --tenant $TENANT_ID`, with all three values sourced from
CI secrets, then run `npx rayfin login status` before deployment.