p0 Commands and Usage
Complete reference for P0 CLI commands including login, SSH, access requests, AWS role assumption, and Kubernetes configuration.
p0 CLI Overview
A developer-focused overview of all p0 CLI commands. Use this as your launchpad, each section links to in-depth docs with examples, flags, and troubleshooting.
📥 p0 login
Bootstrap your local CLI with your organization's credentials and config.
If you run any command it will run this command if you are not logged in.
Purpose:
Launch browser SSO (Google, Okta, Ping, Microsoft, etc.)
Persist tokens & config under
~/.p0/(or$TMP/p0if you set theP0_ORGenvironment variable)
Outcome:
Validated Org access
Ability to run
p0 request,p0 ssh,p0 aws, and more without re-authenticating
Key Flags:
p0 login <ORG_ID>P0_ORG=<ORG_ID> p0 login(for multi-organization access or env var shortcut)
🚪 p0 logout
Remove all P0 CLI credentials, config files, and cached data from your system.
Purpose:
Delete saved identity/authentication tokens
Remove local configuration files (
~/.p0/config.json)Clear CLI session caches
Syntax:
Outcome:
Ensures no sensitive data persists after use
Requires a fresh
p0 loginbefore running other commands
Notes:
Recommended on shared systems, CI environments, or when rotating credentials.
All privileged CLI commands will prompt re-authentication after logout.
☁️ p0 aws role assume
Assume AWS IAM roles through Okta SAML federation.
Purpose:
Obtain temporary AWS credentials via just-in-time access
Authenticate through Okta SAML to assume IAM roles
Output shell export commands for AWS CLI usage
Key Flags:
--account <id>(AWS account ID or alias)--reason <text>(justification for audit)--no-request(skip access request if you have existing access)
Syntax:
☁️ p0 aws permission-set assume
Assume AWS permission sets through AWS Identity Center (IDC).
Purpose:
Obtain temporary AWS credentials via just-in-time access
Authenticate through AWS Identity Center to assume permission sets
Output shell export commands for AWS CLI usage
Key Flags:
--account <id>(AWS account ID or alias)--reason <text>(justification for audit)
Syntax:
The CLI shows either p0 aws role or p0 aws permission-set based on your AWS account configuration. Run p0 aws --help to see which is available.
🗄️ p0 aws rds generate-db-auth-token
Request just-in-time access to an Amazon RDS database and generate an IAM authentication token.
Purpose:
Request access to a PostgreSQL or MySQL role through P0
Generate an RDS IAM authentication token after approval
Output database-specific connection instructions
Key Flags:
--arch <postgres|mysql>(database architecture, required)--role <name>(database role, required)--instance <id>(P0 instance identifier)--database <name>(target database)
Syntax:
☸️ p0 kubeconfig
Just-in-time AWS EKS access and kubeconfig automation.
Purpose:
Request AWS EKS cluster access via p0
Automatically update your
~/.kube/configcontext
Key Flags:
--cluster <CLUSTER_ID>(registered in p0)--role <ClusterRole|CuratedRole|Role>--resource <Kind> / <Namespace> / <Name>--reason "<REASON>"--duration "<DURATION>"
🔓 p0 allow
Declare pre-approved access grants for p0 Request across multiple platforms.
Purpose:
Provision any access that you can request. This is for creating pre-approved access for another user for a period of time. You must be a valid approver for that person.
Apply policy guardrails and auto-revoke at expiry
Key Flags:
--to <principal>(user, service account, or group)--length <total duration>--duration <session TTL>Optional:
--start <timestamp>,--reason <text>
🎫 p0 grant
Issue ephemeral, just-in-time access requests for short-lived tasks.
Purpose:
Trigger provisioning workflows on demand
Optionally block (
--wait) until approval or denial
Key Flags:
--to <principal>--duration <duration>Optional:
--reason <text>,-w/--wait
🔍 p0 ls
Discover valid resource identifiers for grant, allow, ssh, and more.
Purpose:
List ARNs, roles, permission-sets, groups, SSH sessions, etc.
Mark items you already have (
*)
Key Flags:
p0 ls <integration> <subcommand> [filters]--size <N>(pagination)--json(raw output)
📂 p0 scp
Securely copy files using P0-provisioned SSH under the hood.
Purpose:
Drop-in replacement for
scpwith automatic access requests
Syntax:
Key Flags:
--provider <aws|gcloud|azure>--reason <text>--sudo--debug
🔌 p0 ssh-proxy
Expose P0's SSH tunnel as a ProxyCommand for custom SSH configs.
This is not for direct usage via CLI but through other CLI commands.
Purpose:
Integrate P0's managed tunnel (
aws ssm start-session,gcloud iap-tunnel, Azure) into~/.ssh/configReuse approved sessions across multiple SSH calls
Syntax:
🤖 p0 claude mcp add
Connect a Claude Code client to an MCP server gated by the P0 AI Gateway.
Purpose:
Register (or reuse) a P0 OAuth client for this machine
Resolve the gated server's URL from your P0 tenant and write it into your Claude Code MCP config
Key Flags:
<server>(required: the MCP server key; runp0 claude mcp listto see options)-s,--scope <local|user|project>(Claude config scope; defaultlocal)--callbackPort <port>(OAuth callback port; default52566)
Syntax:
🤖 p0 claude mcp list
List the MCP servers configured behind the P0 AI Gateway and available to you.
Purpose:
Discover the server keys you pass to
p0 claude mcp addShow each available server's gateway URL
Syntax:
📑 p0 ssh-resolve
Resolves host names in the SSH command if they are accessible to you without manual approval.
This is not for direct execution, and is used by ssh config file!
Purpose:
Generate approved requests and credentials.
Perfect for automation, editor plugins, or CI pipelines
Syntax:
Last updated