> ## Documentation Index > Fetch the complete documentation index at: https://aspect.build/llms.txt > Use this file to discover all available pages before exploring further. # Auth `function` **Auth.configure**

        
          def Auth.configure(
          host: str,
          \*,
          name: None | str = None,
          make\_default: bool = False,
          issuer: None | str = None
          ) -> typing.Any

Discover a deployment's auth config from its `/.well-known/oauth-protected-resource` document and record it in `~/.aspect/config.json` (replacing any entry of the same derived/`name` deployment). Returns a \[`DeploymentInfo`] the caller uses to report the result and decide whether to run the interactive login. `name` overrides the host-derived deployment name. `make_default` forces this deployment to become the default (taking the crown from any other); otherwise it becomes the default only when none is set yet — a second configure never hijacks it. `issuer` selects among advertised authorization servers (\[`resolve_auth_server`]): when set it must match an advertised one (else `"issuer_not_advertised"`, records nothing), and it is required only when the deployment advertises more than one — an unset `issuer` there records nothing and returns `"needs_issuer"` for the task to resolve. `function` **Auth.configure\_default**

        
          def Auth.configure\_default() -> typing.Any

Discover and record the Aspect Cloud endpoints the built-in entry fronts (\[`DEFAULT_DISCOVERY_HOST`] under \[`ASPECT_CLOUD_DEPLOYMENT_NAME`]), so a bare `aspect auth login` leaves `--remote` working without a separate `auth configure`. Returns the same \[`DeploymentInfo`] shape as \[`Self::configure`]; the caller treats any non-`"ok"` status as "skip and carry on", never as a login failure. Never fails, unlike \[`Self::configure`]. This step is not what the user asked for — they asked to log in — so an unwritable `config.json` must cost them the endpoints, not the login. A failure comes back as `"not_recorded"` carrying the reason, which the caller reports below the login summary. The issuer is pinned to \[`DEFAULT_ISSUER`] rather than taken from the document: discovery here is not user-initiated (the host is compiled in, not typed), so the endpoint may name the PKCE client to use but may not redirect Aspect Cloud's login to a different authorization server. A document advertising only some other issuer resolves to `"issuer_not_advertised"` and records nothing. `function` **Auth.credentials**

        
          def Auth.credentials(
          \*,
          deployment: None | str = None,
          profile: None | str = None,
          required: bool = True
          ) -> typing.Any

`profile`'s credential for `deployment`, or `None` when it holds none. `deployment` is taken as given rather than normalized: callers pass a name `deployment_for_host` resolved, which is already canonical. An expired credential is refreshed first; one whose refresh came back for another organization ends the task (\[`RefreshFailure::TenantChanged`]), whatever `required` says. `function` **Auth.deployment\_api\_url**

        
          def Auth.deployment\_api\_url(
          \*,
          deployment: None | str = None
          ) -> str

The API base of `deployment` (or the default one), for a route a deployment serves itself. Errors when it advertises no API. `function` **Auth.deployment\_endpoints**

        
          def Auth.deployment\_endpoints(
          \*,
          deployment: None | str = None
          ) -> typing.Any

The Bazel-facing endpoints (`cache`/`bes`/`exec` hosts) advertised by the deployment named `deployment` (or the default when omitted), plus its `results_url` viewer, so `aspect --remote` can auto-wire --remote\_cache, the BES backend, --remote\_executor, and --bes\_results\_url. Errors if the deployment names no configured deployment. A deployment that advertised no endpoints (an older discovery, or the built-in Aspect seed) returns empty strings — the task then injects nothing and relies on the user's own flags. `function` **Auth.deployment\_for\_host**

        
          def Auth.deployment\_for\_host(host: str) -> typing.Any

The name of the configured deployment that owns `host` (its advertised cache/bes/exec host), or `None` when none claims it. Endpoint auth uses this to attach a deployment's own login credential to its endpoints (the deployment name is also the credential-store key it logged in under). `function` **Auth.deployment\_summary**

        
          def Auth.deployment\_summary(deployment: str) -> typing.Any

The \[`DeploymentSummary`] for one named deployment (same detail as a `list` row), or `None` when it isn't configured. Lets `configure` show the recorded deployment exactly as `list` renders it. `function` **Auth.deployments**

        
          def Auth.deployments() -> typing.Any

Every effective deployment (built-in seed + configured) as \[`DeploymentEndpoints`] rows, in config order. Reads only the deployment config — never the credential store — so it works where `list` cannot (no keyring, no login); use `list` when login status matters. `function` **Auth.list**

        
          def Auth.list() -> typing.Any

List every effective deployment (built-in seed + configured) as \[`DeploymentSummary`] rows for the `auth status` task. `function` **Auth.login**

        
          def Auth.login(
          \*,
          token: str = ...,
          api\_token: str = ...,
          deployment: str = ...
          ) -> typing.Any

`function` **Auth.login\_profile**

        
          def Auth.login\_profile(
          \*,
          deployment: None | str = None
          ) -> typing.Any

The key a login against `deployment` is filed under within a profile: its canonical name, so an alias resolves to the name \[`Self::deployment_for_host`] later hands back for its endpoints. `function` **Auth.logout**

        
          def Auth.logout(
          \*,
          deployment: None | str = None,
          profile: None | str = None,
          all: bool = False
          ) -> typing.Any

Log out. `all` clears every credential of every profile. Otherwise it clears one deployment's credential in one profile: the deployment named `deployment` — or, when none is given, the effective default deployment — as `profile`, defaulting to \[`resolve_profile`]. Only that one credential: logging out of one deployment leaves the same profile's other logins alone, and logging out as one profile never touches another identity's. Logging out of the current default configured deployment also clears the default (there is no fall-through to another configured deployment): a later command with no `--deployment` then resolves Aspect Cloud, or errors if it needs a login. Returns the name that was logged out (empty for `all`). `function` **Auth.persist**

              
          def Auth.persist(
          creds: typing.Any,
          \*,
          deployment: None | str = None,
          profile: None | str = None
          ) -> typing.Any
        
      
    

File `creds` for `deployment` under `profile`. `deployment` names what the credential talks to — omitted means the effective default deployment — and is normalized, so the Aspect Cloud alias files where Aspect Cloud's canonical name does. `profile` names who holds it, defaulting to \[`resolve_profile`]; every other deployment in that profile, and every other profile, is left alone. `function` **Auth.remove**

        
          def Auth.remove(deployment: str) -> typing.Any

Forget a configured deployment: drop its `~/.aspect/config.json` entry and its stored credential. Errors on the built-in Aspect Cloud entry or an unknown name. `function` **Auth.set\_default**

        
          def Auth.set\_default(deployment: str) -> typing.Any

Make `deployment` the default (used when a command runs with no explicit `--deployment`). Selecting the built-in Aspect Cloud entry is expressed as clearing every configured default. Errors if `deployment` names no configured deployment. `function` **Auth.shadowed**

        
          def Auth.shadowed() -> typing.Any

The `config.json` deployments ignored for claiming a name reserved by the built-in Aspect Cloud entry, as \[`ShadowedDeployment`] rows, so `auth status` can name them (and the file to fix) rather than let them vanish silently. `property` **Auth.aspect\_cloud\_api\_url**

        
          Auth.aspect\_cloud\_api\_url: str

Aspect Cloud's API base. Pair it with a credential for \[`Self::aspect_cloud_deployment`]: the routes served here accept only Aspect Cloud's own tokens. `property` **Auth.aspect\_cloud\_deployment**

        
          Auth.aspect\_cloud\_deployment: str

Aspect Cloud's deployment name, for addressing its credential explicitly rather than taking whichever deployment happens to be default. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.