Before you can automate actions on Astro, you must prove to Astro that your automation tool has the correct identity and access to interact with specific Astro resources. Complete the following actions to authenticate to Astro using the Astro CLI and API tokens:
After you complete this setup, your automation environment is authenticated to Astro. You can then write and run scripts to manage your Deployments through CI/CD.
Astro’s authentication process is based on the Auth0 Identifier First Authentication flow. This process doesn’t provide authorization and isn’t affected by what a user can do in Astro. To manage authorization in Astro, see User permissions.
You can use any of the following credentials to authenticate in an automated process:
When you create an API token for your environment, keep the following best practices in mind:
Always give your API token the minimum permissions required to perform an action. This improves control and security over your Astro components. For example, instead of creating an Organization API token to automate actions across two Workspaces, create a separate Workspace API token for each Workspace.
Always set an expiration date for your API tokens.
Always rotate your API tokens for enhanced security.
To manage your Astro workflows programmatically, you must install the Astro CLI in the environment which will run the workflows. Typically, this requires running curl -sSL install.astronomer.io | sudo bash -s or an equivalent installation command before your process starts. See CI/CD templates for examples of how to install the Astro CLI in different version management and workflow automation environments.
To make your API token accessible to the Astro CLI, you need to set specific environment variables in your CI/CD tool or automation environment.
To use a Deployment, Workspace, or Organization API token as an authentication credential, set the following environment variable in your script: