---
title: "Authenticate on the CLI | Grafana Cloud documentation"
description: "How to authenticate on the k6 CLI with a Grafana Cloud k6 app token"
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# Authenticate on the CLI

To run [cloud tests from the CLI](/docs/grafana-cloud/testing/k6/get-started/run-cloud-tests-from-the-cli/), you need to authenticate your account. Authentication is required both for tests that run on the cloud service and for results that stream to the cloud service. To authenticate accounts, k6 provides an API token, which you can pass on the CLI or through the REST API.

You can generate two types of API tokens for Grafana Cloud k6, depending on how you want to authenticate:

- [Personal level API tokens](#get-a-personal-api-token) grant access through your account with the Grafana Cloud k6 App.
- [Stack level API tokens](#get-a-grafana-stack-api-token) grant access for actions not tied to a user but to the Grafana Cloud Stack.

To generate API tokens, follow these steps.

## Get a personal API token

A personal API token provides API access to your account with k6.

To get a personal API token:

1. Log in to your Grafana Cloud account and open a stack.
2. On the main menu, click **Testing & synthetics** -> **Performance** -> **Settings**.
3. Under **Access**, click **Personal token**. Here you can view, copy, and regenerate your personal API token.

> Note
> 
> k6 API tokens don’t have an expiration date. If you want to rotate your k6 keys, you have to do it manually. It’s recommended that you rotate your k6 keys periodically to ensure appropriate security.

## Get a Grafana Stack API token

> Note
> 
> Only [admins](/docs/grafana-cloud/testing/k6/projects-and-users/configure-rbac/) can access and manage these tokens.

A Stack API token provides access to all projects within the Grafana Cloud Stack. You can use it to run tests without linking the run to a specific user, for example, when running tests from a CI platform.

To generate a token, follow these steps:

1. Log in to your Grafana Cloud account and open a stack.
2. On the main menu, click **Testing & synthetics** -> **Performance** -> **Settings**.
3. Under **Access**, click **Stack token**.

On this section, you can view, create, and regenerate any tokens.

By default, organizations can create a maximum of 5 tokens.

Note that you must specify the project where the test runs will be created when using a non-personal token. Refer to [Cloud options](/docs/grafana-cloud/testing/k6/author-run/cloud-scripting-extras/cloud-options/) to learn how to set the `projectID`.

## Authenticate with the `login` command

To authenticate interactively, run `k6 cloud login` without any flags. k6 prompts you for your API token and a [stack](/docs/grafana-cloud/security-and-account-management/cloud-stacks/). The stack can be either a full URL (for example, `https://my-team.grafana.net`) or just a slug (for example, `my-team`):

Bash ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```bash
k6 cloud login
```

To authenticate non-interactively, pass your token directly with the `--token` flag, and a stack with the `--stack` flag:

Bash ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```bash
k6 cloud login --token @@@K6_API_TOKEN@@@ --stack @@@K6_STACK_URL@@@
```

`k6 cloud login` stores your API token and your stack information in a local configuration file to authenticate with when running cloud commands. Unless your token changes or you run tests on multiple cloud accounts, you need to run `k6 cloud login` only once.

### View or reset stored credentials

To display the currently stored token and stack information, use the `--show` flag:

Bash ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```bash
k6 cloud login --show
```

To clear all stored credentials (token and stack information), use the `--reset` flag:

Bash ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```bash
k6 cloud login --reset
```

## Authenticate with an environment variable

You can also authenticate with your Grafana Cloud k6 authentication token via [environment variables](/docs/k6/latest/using-k6/environment-variables/). Make sure you have set the `K6_CLOUD_TOKEN` as your authentication token, and k6 picks it up when running.

Bash ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```bash
## run a cloud test
K6_CLOUD_TOKEN=$TOKEN k6 cloud run script.js

## run locally and stream to the cloud
K6_CLOUD_TOKEN=$TOKEN k6 cloud run --local-execution script.js
```

> Note
> 
> The `stackID` option is available in k6 v1.6.0 and later.

You can also use an environment variable to set the stack you want to use, using your stack ID.

Bash ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```bash
## run a cloud test
K6_CLOUD_TOKEN=$TOKEN K6_CLOUD_STACK_ID=@@@K6_STACK_ID@@@ k6 cloud run script.js

## run locally and stream to the cloud
K6_CLOUD_TOKEN=$TOKEN K6_CLOUD_STACK_ID=@@@K6_STACK_ID@@@ k6 cloud run --local-execution script.js
```

To get your stack ID, follow these steps:

1. Log in to your Grafana Cloud account and open a stack.
2. On the main menu, click **Testing & synthetics** -> **Performance** -> **Settings**.
3. Under **Access**, click **Stack ID**.

## Authenticate with a configuration file

You can also directly add your authentication token to a configuration file:

- On Linux:
  
  Bash ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy
  
  ```bash
  ${HOME}/.config/k6/config.json
  ```
- On Mac
  
  Bash ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy
  
  ```bash
  ${HOME}/Library/Application Support/k6/config.json
  ```
- On Windows
  
  Bash ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy
  
  ```bash
  C:\Users\<User>\AppData\Roaming\k6\config.json
  ```

Or, set the configuration path with the `-c/--config PATH/TO/CONFIG_FILE` CLI flag.

After your token has been added to the configuration file, it should look something like this:

JSON ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```json
{
  "collectors": {
    "cloud": {
      "stackID": 12345,
      "stackURL": "https://stack-slug.grafana.net",
      "defaultProjectID": 123,
      "token": "YOUR_API_AUTH_TOKEN"
    }
  }
}
```

### Authenticate in a Docker container

If you’re running k6 in a Docker container, the `-c/--config` CLI flag is the recommended approach. This ensures that the k6 configuration file where the API authentication information is stored is persisted via a Docker volume to the host machine.

Bash ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```bash
docker run --rm -i -v /path/on-host:/path/in-container/ grafana/k6 \
login cloud -c /path/in-container/config.json
```