DF_PASSWORD

Password for control-plane authentication. Presence marks credentials as explicit (skips interactive prompt). Default: admin123 (for local dev only).

Syntax

DF_PASSWORD=<PASSWORD>

Description

## Overview `DF_PASSWORD` supplies the secret used during the control plane login. When this env var (or `--password`) is set, the CLI treats credentials as explicit: it skips the TUI login wizard and the inline stdin password prompt. This is the standard way to run the CLI non-interactively from CI, cron, or scripted automation. ## Behavior - Read by `std::env::var("DF_PASSWORD")` at CLI startup via `CliConfig::from_env`. - Default when unset and no profile is loaded: `admin123`. This default is meant for a freshly-installed local control plane and is not appropriate for any shared or remote deployment. - Presence sets `credentials_explicit = true`, which suppresses both the interactive wizard and the stdin prompt. - Overridden at runtime by `--password`. Overrides `password` in the active profile. - The CLI sends the password once to authenticate; the session token, not the password, is used for subsequent requests in the same process. ## Resolution - `--password` flag (highest) - `DF_PASSWORD` - `password` in the active profile of `~/.deltaforge/config.toml` - Built-in default `admin123` (lowest; local dev only)

Examples

# Read from pass(1) so the literal is not in shell history
DF_PASSWORD=$(pass show deltaforge/prod) delta-forge-cli

# Azure Key Vault (one of DeltaForge's supported credential backends)
export DF_PASSWORD=$(az keyvault secret show --vault-name my-keyvault --name deltaforge-prod-password --query value -o tsv)
delta-forge-cli run migrations/001.sql

# libsecret via secret-tool
export DF_PASSWORD=$(secret-tool lookup service deltaforge account $DF_USERNAME)
delta-forge-cli

# GitHub Actions: credentials come from repo/org secrets
- name: Deploy pipelines
  env:
    DF_USERNAME: ${{ secrets.DF_USERNAME }}
    DF_PASSWORD: ${{ secrets.DF_PASSWORD }}
  run: delta-forge-cli run deploy/

# Read from stdin once, keep out of environment of child processes
read -rs DF_PASSWORD
export DF_PASSWORD
delta-forge-cli

Pitfalls

• If nothing else is set, the CLI will try to authenticate with the built-in dev default `admin123` against whatever control plane `DF_CONTROL_URL` points at. In non-local environments this both fails and leaks a login attempt into audit logs.
• Captured once at process start. Rotating the password in your secret store does not affect an already-running CLI; relaunch to pick up the new value.
• Setting `DF_PASSWORD` suppresses the interactive prompt even if it is wrong. The CLI will exit with an auth error rather than falling back to asking; double-check the value in automated contexts before treating a failure as a server issue.

See Also

• CLI_FLAG_PASSWORD
• CLI_AUTH_FLOW
• CLI_CONFIG_PROFILES