---
name: cli-cri-token-login
title: Logging in with a Compute Resource Token
description: You can use a trusted profile to set up fine-grained authorization for applications that are running in compute resources. As a result, you aren't required to create service IDs or API keys for the compute resources. The IBM Cloud CLI supports logging in and authenticating to IBM Cloud by using an IBM Cloud Kubernetes Service compute resource. For instructions about logging in as a Virtual Server Instance for VPC compute resource by using the IBM Cloud CLI, see Logging in as a Virtual Server Instance Compute Resource Identity.
last-updated: 2026-08-17
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/cli?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Logging in with a Compute Resource Token
{: #cri-login}

You can use a trusted profile to set up fine-grained authorization for applications that are running in compute resources. As a result, you aren't required to create service IDs or API keys for the compute resources. The IBM Cloud CLI supports logging in and authenticating to IBM Cloud by using an IBM Cloud Kubernetes Service compute resource. For instructions about logging in as a Virtual Server Instance for VPC compute resource by using the IBM Cloud CLI, see [Logging in as a Virtual Server Instance Compute Resource Identity](https://cloud.ibm.com/docs/cli?topic=cli-vsi-cri-login&format=markdown).
{: shortdesc}

For more information about managing trusted profiles and establishing trust with compute resources, see [Establishing trust with compute resources](https://cloud.ibm.com/docs/iam?topic=iam-create-trusted-profile&format=markdown#create-profile-compute).

## Using the CLI to log in
{: #cri-cli-login}

To use the IBM Cloud CLI Kubernetes Service compute resource login feature, you must give application pods that run in your IBM Cloud Kubernetes Service cluster access to IBM Cloud services. For more information, see [Authorizing pods in your cluster to IBM Cloud services with IAM trusted profiles](https://cloud.ibm.com/docs/containers?topic=containers-pod-iam-identity&interface=ui&format=markdown). For Red Hat OpenShift clusters, see [Authorizing pods in your Red Hat OpenShift cluster to IBM Cloud services with IAM trusted profiles](https://cloud.ibm.com/docs/openshift?topic=openshift-pod-iam-identity&interface=ui&format=markdown).

### Using a Compute Resource Token to log in with the CLI
{: #tokenflag_login}

When you use the compute resource token option to log in with a service account-projected token, you specify the compute resource token parameter to enter at login.

You can log in with a compute resource token with the CLI in any of the following ways:

* Call the Compute Resource token directly:
   1. Specify the `--cr-token` option with the `ibmcloud login` command, and provide the content of the compute resource token.
   2. Specify the `--profile` option with the `ibmcloud login` command, and provide the ID, name, or CRN of the IAM trusted profile that the cluster is linked to.

   ```text
   ibmcloud login --cr-token TOKEN_STRING --profile PROFILE_ID_NAME_OR_CRN_STRING
   ```
   {: codeblock}

* Call the Compute Resource token with the token file:
   1. Specify the `--cr-token` option with the `ibmcloud login` command, and provide the file path of a compute resource token file.
   2. Specify the `--profile` option with the `ibmcloud login` command, and provide the ID, name, or CRN of the IAM trusted profile that the cluster is linked to.

   ```text
   ibmcloud login --cr-token @token_file_name --profile PROFILE_ID_NAME_OR_CRN_STRING
   ```
   {: codeblock}

* Set the `IBMCLOUD_CR_TOKEN` environment variable.

   Additionally, you can set the environment variable on your system. For example, set `IBMCLOUD_CR_TOKEN=token_string`, where `token_string` is the custom value of the compute resource token, or `IBMCLOUD_CR_TOKEN=@token_file_name`, where `@token_file_name` is the file path of a compute resource token file that contains the contents of the token. After the environment variable is set, you can simply specify `ibmcloud login --profile <profile_id_name_or_crn_string>` from the CLI.

* Set both `IBMCLOUD_CR_TOKEN` and `IBMCLOUD_CR_PROFILE` environment variables.

   Additionally, you can set both environment variables on your system. For example, `IBMCLOUD_CR_TOKEN=token_string`, where `token_string` is the custom value of the compute resource token, and `IBMCLOUD_CR_PROFILE=profile_id_name_or_crn_string`, where `profile_id_name_or_crn_string` is the ID, name, or CRN of the IAM trusted profile that the cluster is linked to. After both environment variables are set, you can simply specify `ibmcloud login` from the CLI.

The resulting login session is valid for 60 minutes.
{: note}