# p0 login
### **Overview**
The p0 login command bootstraps your local CLI with the credentials and configuration for your P0 organization. Once you've logged in, the CLI can:
* Save your org's configuration locally (endpoints, OAuth client IDs, etc.)
* Launch a browser SSO flow for your org's identity provider (Google, Okta, Ping, Duo, Microsoft OIDC, etc.)
* Let you start running p0 request, p0 aws, p0 ssh, and other commands without re-authenticating on each call
* If your saved token expires, the CLI will automatically re-launch the login flow and update the identity file before retrying any command.
***
### **Basic Login**
#### **1. Run the login command**
```plaintext
p0 login
```
Replace \ with your P0 organization's ID. This will:
1. Fetch your org's information (to get OAuth client IDs & tenant ID).
2. Save that org's config to \~/.p0/config.json (or, if you've set P0\_ORG, to a temp-directory config).
3. Launch your browser to authenticate via your org's SSO provider.
4. Persist the resulting ID/token bundle to an identity file.
5. Print "You are now logged in, and can use the p0 CLI."
#### **2. (Optional) Use P0\_ORG env var**
The `P0_ORG` environment variable is primarily used when you need to be authenticated to multiple P0 organizations simultaneously — for example, to SSH into instances across different orgs in the same shell session:
```plaintext
P0_ORG=org-one p0 login
P0_ORG=org-two p0 login
```
For multi-organization SSH setup, see [Multi-organization SSH access](/integrations/resource-integrations/ssh.md#multi-organization-ssh-access).
{% hint style="info" %}
You can also export `P0_ORG` for single-org use so you don't need to type the org ID each time:
`export P0_ORG=acme-corp`\
`p0 login`
{% endhint %}
***
### **What Files Are Created**
| | File
Purpose
|
| ------------------------------------- | ----------------------------------------------------------- |
| *(or $TMP/p0/config.json-\)* | When P0\_ORG is set, alternate location |
| \~/.p0/identity.json | Your saved token + org slug + expiry time |
| *(or $TMP/p0/identity.json)* | When P0\_ORG is set |
Files are stored with restrictive permissions (600) so only you can read them.
***
### **Supported SSO Providers**
P0 CLI detects your org's SSO Provider and we pick the appropriate flow.
* **Google** / **Google-OIDC**
* **Okta**
* **Ping**
* **Duo**
* **Microsoft** / **Azure-OIDC**
If your org uses a custom or unsupported provider, you see an "Unsupported login for your organization" error.
***
### **Troubleshooting**
* **"Couldn't find organization"**
• Verify your org ID is correct and spelled exactly as given.
* **Browser didn't open / SSO popup blocked**
• Be sure your $BROWSER env var is set or you have a default browser configured.
• Check your popup-blocker settings.
* **"Please run p0 login \ to use the P0 CLI."**
Indicates no identity file was found. Simply re-run the login command.
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://docs.p0.dev/p0-cli/p0-commands-and-usage/p0-login.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.