Password for control-plane authentication. Presence marks credentials as explicit (skips interactive prompt).
--password <PASSWORD> (env: DF_PASSWORD)## Overview `--password` supplies the secret that the CLI sends to the control plane alongside the username during authentication. When both `--username` and `--password` are present (through any tier of resolution), the CLI treats credentials as explicit and does not display the TUI login wizard or the inline stdin prompt. The built-in default is `admin123`, which is only safe for local development installs. Any non-dev environment should override this via the flag, env var, or interactive prompt. ## Behavior - The value is sent verbatim as the `password` field of the authentication request. - Marking credentials explicit is a side effect of the flag being set, regardless of whether the paired username is valid. A wrong explicit username and password fails with an authentication error instead of prompting. - The password is never read from the active profile. Profiles are not a secret store. - For long-running REPL sessions, the password is used once to acquire a token and retained in memory for refresh. It is not persisted to disk. ## Compatibility Resolution order: `--password`, `DF_PASSWORD`, interactive prompt, built-in default `admin123`. A non-TTY invocation without `--password` or `DF_PASSWORD` falls through to the default, which is almost never the intended behaviour against a shared control plane.
# One-shot query with explicit credentials
delta-forge-cli --username u --password p query SELECT 1# Fetch from a secret store at invocation time
DF_PASSWORD=$(secret-tool lookup deltaforge) delta-forge-cli# CI pipeline with env-supplied secret
DF_USERNAME=ci@example.com DF_PASSWORD=$CI_DF_PASSWORD delta-forge-cli run ci/migrate.sql# Pair with a profile for URLs; the flag supplies identity
delta-forge-cli --profile production --username ops@example.com --password $OPS_PASS health