Docs
flxbl.ioStatusContact us
codevsfp CLIsfp serverlibraries

User

Create and manage server users

sfp server user add

This command adds a user to sfp/sfops backend db

USAGE
  $ sfp server user add -f <value> -l <value> --target-email <value> -m <value> [--json] [--repository <value>] [-e
    <value>] [-t <value>] [--sfp-server-url <value>] [-r owner|member] [-g <value>...] [--loglevel
    trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL]

FLAGS
  -e, --email=<value>               Email address for authenticated user. Ignored if --application-token is provided.
                                    Can be set via SFP_SERVER_USER env var.
  -f, --firstname=<value>           (required) Firstname of the user
  -g, --logsgroupsymbol=<value>...  Symbol used by CICD platform to group/collapse logs in the console. Provide an
                                    opening group, and an optional closing group symbol.
  -l, --lastname=<value>            (required) Lastname of the user
  -m, --team=<value>                (required) Team the user belongs to
  -r, --role=<option>               [default: member] Role of the user, could be owner/member
                                    <options: owner|member>
  -t, --application-token=<value>   Application token for CI/CD authentication. Can be set via SFP_SERVER_TOKEN env var
                                    (CLI flags take precedence over env vars).
      --loglevel=<option>           [default: info] logging level for this command invocation
                                    <options: trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL>
      --repository=<value>          The repository identifier. E.g `owner/repo` for GitHub/GitLab or `org/project/repo`
                                    for Azure DevOps
      --sfp-server-url=<value>      URL of the SFP server. Can be set via SFP_SERVER_URL env var or config: sfp
                                    config:set server-url
      --target-email=<value>        (required) Email address of the user to add

GLOBAL FLAGS
  --json  Format output as json.

DESCRIPTION
  This command adds a user to sfp/sfops backend db

EXAMPLES
  $ sfp server user add --firstname "John" --lastname "Doe" --target-email "john@example.com" --team "engineering" --role member

sfp server user delete

This command deletes a user to sfp/sfops backend db

USAGE
  $ sfp server user delete -m <value> --target-email <value> [-j] [--repository <value>] [-e <value>] [-t <value>]
    [--sfp-server-url <value>] [-g <value>...] [--loglevel
    trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL]

FLAGS
  -e, --email=<value>               Email address for authenticated user. Ignored if --application-token is provided.
                                    Can be set via SFP_SERVER_USER env var.
  -g, --logsgroupsymbol=<value>...  Symbol used by CICD platform to group/collapse logs in the console. Provide an
                                    opening group, and an optional closing group symbol.
  -j, --json                        Use json format
  -m, --team=<value>                (required) Team the user belongs to
  -t, --application-token=<value>   Application token for CI/CD authentication. Can be set via SFP_SERVER_TOKEN env var
                                    (CLI flags take precedence over env vars).
      --loglevel=<option>           [default: info] logging level for this command invocation
                                    <options: trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL>
      --repository=<value>          The repository identifier. E.g `owner/repo` for GitHub/GitLab or `org/project/repo`
                                    for Azure DevOps
      --sfp-server-url=<value>      URL of the SFP server. Can be set via SFP_SERVER_URL env var or config: sfp
                                    config:set server-url
      --target-email=<value>        (required) Email address(es) of the user(s) to remove (comma-separated for multiple)

DESCRIPTION
  This command deletes a user to sfp/sfops backend db

EXAMPLES
  $ sfp server user delete --team engineering --target-email "john@example.com"

  $ sfp server user delete --team engineering --target-email "john@example.com,jane@example.com"

sfp server user invite

Re-send the sign-in email to a member of this sfp server (flxbl cloud tenants). The mail is sent by the global auth service and tells the user how to open codev and sign in — with GitHub / Azure DevOps / SSO using this email, or by setting a password if they prefer email sign-in.

USAGE
  $ sfp server user invite --target-email <value> [--json] [--repository <value>] [-e <value>] [-t <value>]
    [--sfp-server-url <value>] [-g <value>...] [--loglevel
    trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL]

FLAGS
  -e, --email=<value>               Email address for authenticated user. Ignored if --application-token is provided.
                                    Can be set via SFP_SERVER_USER env var.
  -g, --logsgroupsymbol=<value>...  Symbol used by CICD platform to group/collapse logs in the console. Provide an
                                    opening group, and an optional closing group symbol.
  -t, --application-token=<value>   Application token for CI/CD authentication. Can be set via SFP_SERVER_TOKEN env var
                                    (CLI flags take precedence over env vars).
      --loglevel=<option>           [default: info] logging level for this command invocation
                                    <options: trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL>
      --repository=<value>          The repository identifier. E.g `owner/repo` for GitHub/GitLab or `org/project/repo`
                                    for Azure DevOps
      --sfp-server-url=<value>      URL of the SFP server. Can be set via SFP_SERVER_URL env var or config: sfp
                                    config:set server-url
      --target-email=<value>        (required) Email address of the member to send the sign-in email to

GLOBAL FLAGS
  --json  Format output as json.

DESCRIPTION
  Re-send the sign-in email to a member of this sfp server (flxbl cloud tenants). The mail is sent by the global auth
  service and tells the user how to open codev and sign in — with GitHub / Azure DevOps / SSO using this email, or by
  setting a password if they prefer email sign-in.

EXAMPLES
  $ sfp server user invite --target-email "john@example.com"

sfp server user mfa reset

Remove every authenticator (TOTP) factor of a tenant-local user so their next password sign-in re-enrols. Servers enforce two-factor authentication for password sign-ins by default (AUTH_PASSWORD_REQUIRE_MFA, opt out with false), so this is the recovery path when an admin loses their authenticator app. Uses the tenant's service role (SUPABASE_URL + SUPABASE_SERVICE_KEY) and therefore works even when nobody can sign in. Global-auth (flxbl cloud) users are reset from the flxbl console, not from a tenant.

USAGE
  $ sfp server user mfa reset --target-email <value> [-j] [-g <value>...] [--loglevel
    trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL]

FLAGS
  -g, --logsgroupsymbol=<value>...  Symbol used by CICD platform to group/collapse logs in the console. Provide an
                                    opening group, and an optional closing group symbol.
  -j, --json                        Use json format
      --loglevel=<option>           [default: info] logging level for this command invocation
                                    <options: trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL>
      --target-email=<value>        (required) Email address of the tenant-local user whose authenticator factors should
                                    be removed

DESCRIPTION
  Remove every authenticator (TOTP) factor of a tenant-local user so their next password sign-in re-enrols. Servers
  enforce two-factor authentication for password sign-ins by default (AUTH_PASSWORD_REQUIRE_MFA, opt out with false), so
  this is the recovery path when an admin loses their authenticator app. Uses the tenant's service role (SUPABASE_URL +
  SUPABASE_SERVICE_KEY) and therefore works even when nobody can sign in. Global-auth (flxbl cloud) users are reset from
  the flxbl console, not from a tenant.

EXAMPLES
  $ SUPABASE_URL=https://tenant.example.com SUPABASE_SERVICE_KEY=... sfp server user mfa reset --target-email "admin@example.com"

  $ sfp server user mfa reset --target-email "admin@example.com" --json

Link your own provider identity (GitHub / Azure DevOps) via the server-mediated OAuth device flow

USAGE
  $ sfp server user provider-identity link -p github|azuredevops [--repository <value>] [-e <value>] [-t <value>] [--sfp-server-url
    <value>] [--open]

FLAGS
  -e, --email=<value>              Email address for authenticated user. Ignored if --application-token is provided. Can
                                   be set via SFP_SERVER_USER env var.
  -p, --provider=<option>          (required) Provider to link an identity for
                                   <options: github|azuredevops>
  -t, --application-token=<value>  Application token for CI/CD authentication. Can be set via SFP_SERVER_TOKEN env var
                                   (CLI flags take precedence over env vars).
      --[no-]open                  Open the verification URL in a browser (use --no-open to disable)
      --repository=<value>         The repository identifier. E.g `owner/repo` for GitHub/GitLab or `org/project/repo`
                                   for Azure DevOps
      --sfp-server-url=<value>     URL of the SFP server. Can be set via SFP_SERVER_URL env var or config: sfp
                                   config:set server-url

DESCRIPTION
  Link your own provider identity (GitHub / Azure DevOps) via the server-mediated OAuth device flow

EXAMPLES
  $ sfp server user provider-identity link --provider github

  $ sfp server user provider-identity link --provider azuredevops --no-open

sfp server user provider-identity list

List your linked provider identities (no tokens are ever returned)

USAGE
  $ sfp server user provider-identity list [--json] [--repository <value>] [-e <value>] [-t <value>] [--sfp-server-url
  <value>]

FLAGS
  -e, --email=<value>              Email address for authenticated user. Ignored if --application-token is provided. Can
                                   be set via SFP_SERVER_USER env var.
  -t, --application-token=<value>  Application token for CI/CD authentication. Can be set via SFP_SERVER_TOKEN env var
                                   (CLI flags take precedence over env vars).
      --repository=<value>         The repository identifier. E.g `owner/repo` for GitHub/GitLab or `org/project/repo`
                                   for Azure DevOps
      --sfp-server-url=<value>     URL of the SFP server. Can be set via SFP_SERVER_URL env var or config: sfp
                                   config:set server-url

GLOBAL FLAGS
  --json  Format output as json.

DESCRIPTION
  List your linked provider identities (no tokens are ever returned)

EXAMPLES
  $ sfp server user provider-identity list

  $ sfp server user provider-identity list --json

sfp server user provider-identity refresh ID

Force a token refresh for a linked provider identity (debug / reconnect)

USAGE
  $ sfp server user provider-identity refresh ID [--json] [--repository <value>] [-e <value>] [-t <value>]
  [--sfp-server-url <value>]

ARGUMENTS
  ID  Identity id to refresh

FLAGS
  -e, --email=<value>              Email address for authenticated user. Ignored if --application-token is provided. Can
                                   be set via SFP_SERVER_USER env var.
  -t, --application-token=<value>  Application token for CI/CD authentication. Can be set via SFP_SERVER_TOKEN env var
                                   (CLI flags take precedence over env vars).
      --repository=<value>         The repository identifier. E.g `owner/repo` for GitHub/GitLab or `org/project/repo`
                                   for Azure DevOps
      --sfp-server-url=<value>     URL of the SFP server. Can be set via SFP_SERVER_URL env var or config: sfp
                                   config:set server-url

GLOBAL FLAGS
  --json  Format output as json.

DESCRIPTION
  Force a token refresh for a linked provider identity (debug / reconnect)

EXAMPLES
  $ sfp server user provider-identity refresh 00000000-0000-0000-0000-000000000000

sfp server user provider-identity revoke ID

Revoke a linked provider identity at the provider and drop its stored credentials

USAGE
  $ sfp server user provider-identity revoke ID [--json] [--repository <value>] [-e <value>] [-t <value>]
  [--sfp-server-url <value>]

ARGUMENTS
  ID  Identity id to revoke

FLAGS
  -e, --email=<value>              Email address for authenticated user. Ignored if --application-token is provided. Can
                                   be set via SFP_SERVER_USER env var.
  -t, --application-token=<value>  Application token for CI/CD authentication. Can be set via SFP_SERVER_TOKEN env var
                                   (CLI flags take precedence over env vars).
      --repository=<value>         The repository identifier. E.g `owner/repo` for GitHub/GitLab or `org/project/repo`
                                   for Azure DevOps
      --sfp-server-url=<value>     URL of the SFP server. Can be set via SFP_SERVER_URL env var or config: sfp
                                   config:set server-url

GLOBAL FLAGS
  --json  Format output as json.

DESCRIPTION
  Revoke a linked provider identity at the provider and drop its stored credentials

EXAMPLES
  $ sfp server user provider-identity revoke 00000000-0000-0000-0000-000000000000

Update

Update a tenant's services to the latest version

Variable

Store and resolve variables and encrypted secrets

On this page

sfp server user addsfp server user deletesfp server user invitesfp server user mfa resetsfp server user provider-identity linksfp server user provider-identity listsfp server user provider-identity refresh IDsfp server user provider-identity revoke ID