Identities and the CLI

Programs read secrets with a machine identity. The identity logs in for a short-lived token and reads only what its grants allow. People use the same monopam CLI with their own sign-in.

Applies to	Who can do this
Monopam v2026.10	Administrators create identities. Developers and pipelines use them.

Machine identities

Machine Identities list with auth types and grants

Figure 1. Secrets → Identities. Client IDs and owners are blurred.

Auth method (1)	Use it for	How it logs in
Universal Auth	CI pipelines, servers, scripts.	A client ID (`mpc_...`) and a client secret.
OIDC	Pipelines that already have an OIDC token (GitHub Actions, GitLab, cloud workloads).	An external token checked against the issuer, audience and bound claims.
Kubernetes	Pods in a cluster.	The pod's own service account token, checked by the cluster. No secret is stored in the cluster.

Click Add New (3), name the identity and choose the auth method.
Add Grants (2): a project, optionally an environment and folder path, and read or read/write.
Optionally limit Allowed IP ranges. Repeated failed logins pause the address.
For Universal Auth, copy the client secret when it is shown. Rotate Secret issues a new one.

The CLI

Command	What it does
`monopam login`	Signs a person in through the browser and saves a profile.
`monopam login --kubernetes <identity>`	Signs a pod in with its service account token.
`monopam run -p <project> -e <env> -- <command>`	Runs a command with the secrets as environment variables.
`monopam export`	Prints the secrets in a chosen format, for example `.env`.
`monopam secrets list`, `monopam secrets set`	Lists or writes keys.
`monopam whoami`	Shows which identity and grants are in use.

Programs can also call the machine API directly: log in, then GET /api/v1/secrets/<project>/<env> with the token.

Machines receive shared entries only. Values scoped to a person, user or group are not returned to machine identities.

Troubleshooting

What you see	Why	What to do
Login fails from a build agent.	The address is outside the identity's Allowed IP ranges, or it was paused after failed logins.	Check the ranges and the audit log entry for the rejected login.

Projects and environments
Vault-compatible API
Access Keys and Database Access Keys