---
title: CLI application authentication
sidebar_label: CLI application authentication
tags: [authentik Agent, authentik cli, kubernetes, k8s, aws, cli]
authentik_version: "2025.12.0"
---

import DocCardList from "@theme/DocCardList";

The authentik Agent can authenticate to CLI applications such as [`aws`](./aws.mdx) and [`kubectl`](./k8s.mdx).

## How CLI authentication works

First, `authentik-agent` and `authentik-cli` request an authentik token from the [authentik-cli OAuth Provider](../../configuration.md#create-an-application-and-provider-in-authentik-for-cli) and exchange it for a token from the specified Kubernetes or AWS provider.

This token is cached until expiration. This improves performance by eliminating repeated token requests.

## More information

For more information, refer to each of the topics below:

<DocCardList />