## 6.1.3.4.3 Log in
Log in with the btp CLI is on global account level.
## Prerequisites
- You need to pass the CLI server URL. Usually, it is proposed during login and you can confirm with ENTER https://cli.btp.cloud.sap/ .
- Note that in clients up until version 2.49.0, the old server URL https://
- cpcli.cf.eu10.hana.ondemand.com is proposed. For the time being, you can use either one, but we recommend to switch to https://cli.btp.cloud.sap/ . If you are in a private cloud and your operator has provided you with a different server URL, you'll have to enter that one.
- To log in successfully, you need access to a global account. See Role Collections and Roles in Global Accounts, Directories, and Subaccounts [page 125].
- To log on with SAP Universal ID, you need to log on with the single sign-on parameter ( btp login --sso ). If you don't want to use single sign-on, log on with the password associated with your account (S-user or P-user) in the default identity provider, SAP ID service. If you have multiple user accounts with the same email address, log on with your user ID (S-user or P-user) instead of your email address. If you've forgotten this password and this user is associated with your SAP Universal ID user, reset your password. For more information, see SAP Note 3085908 and Log in with Single Sign-On [page 2420].
:
## Context
When you log in with the btp CLI, a session token is saved in your local configuration. This allows you to keep your authentication over multiple command calls or after restarting your computer. The maximum session length is 12 hours. After that, you'll have to log in again. If you want to end your login earlier, use btp logout .
## Login with single sign-on
We recommend using single sign-on and authenticating directly at your identity provider through a web browser:
btp login --sso
See Log in with Single Sign-On [page 2420].
## Login with a custom identity provider
To login with a custom identity provider, use:
btp login --sso --idp &lt;TENANT&gt;
See Log in with a Custom Identity Provider [page 2421].
## Procedure
To log in manually, use btp login . The btp CLI prompts for all login information, but optionally, you can provide the required information as parameters.
Usage: btp [OPTIONS] login [PARAMS]
Parameters
--sso
Opens a browser for single sign-on at the identity provider. The btp CLI doesn't prompt for this parameter. If you use SAP Universal ID, you need to use this parameter.
To suppress automatic browser opening, use --sso manual .
<!-- image -->
| --idp <TENANT>        | This parameter is only needed if you want to log in through a custom identity provider. The CLI doesn't prompt for it. If trust is configured between your global account and a cus- tom identity provider, use this parameter to log in through this identity provider by providing its tenant ID. To retrieve the required value, you can run btp list security/ trust and use the value from the Tenant column. Or you can use the Global Account view in the cockpit, under Security → Trust Configuration → Custom Platform Identity Providers . The value is displayed in the BTP CLI column.   |
|-----------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|                       |  Note To work with users from a custom identity provider, you need to specify the --of-idp parameter by provid- ing the origin key of the custom identity provider. This is applicable to the following commands: btp list security/user , btp get security/user , btp delete security/user , btp assign security/role-collection , btp unassign security/role-collection , and you find this origin key in the cockpit under Security .                                                                                                                                                             |
| --url <URL>           | The client proposes this CLI server URL: https:// cli.btp.cloud.sap/ , which you can confirm by pressing ENTER . If your operator has provided you with a different server URL, you can specify it here. Note that when you enter a new server URL for the first time, you're asked to confirm that you trust it.                                                                                                                                                                                                                                                                                     |
| --user <USER>         | Your user name, usually an email address.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| --password <PASSWORD> | Your password. If you have enabled Two-Factor-Authentica- tion, append your token to your password.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
|                       |  Tip Wedon't recommend to provide the password with this parameter, as it appears in plain text and may be re- corded in your shell history. Rather, enter it when you're prompted.                                                                                                                                                                                                                                                                                                                                                                                                                  |
--subdomain &lt;GLOBALACCOUNT&gt;
btp login
If you've logged in before, the server URL, the subdomain, and the user from the last login are suggested. You can then press Enter to confirm, or type in different values.
```
CLI server URL [https://cli.btp.cloud.sap/]> Subdomain [my-global-account]> User [name@example.com]>
```
## Results
Upon successful login, the btp CLI creates a folder ( btp ) and a configuration file ( config.json ) in the default location of your user data directory:
- Microsoft Windows: C:\Users\&lt;username&gt;\AppData\Roaming\SAP\btp\config.json
- Apple macOS ; ~/Library/Application Support/.btp/config.json
- Linux: ~/.config/.btp/config.json
To change this location, use the --config option or the environment variable. See Specify the Location of the Configuration File [page 2431].
##  Tip
You've logged in to the global account and all commands are executed in this global account, unless you provide a subaccount or directory ID with the command. To change this default context for subsequent commands, you can target a subaccount or directory, or even a different global account by using btp target . See Set a Target for Subsequent Commands with btp target [page 2425].
## Related Information
btp CLI Command Reference
In the interactive login, after successful authentication, the btp CLI will offer all of your global accounts so you can select the one to log in to.
You can also provide the global account as a parameter by specifying its subdomain. You should have obtained the subdomain from your operator; but you can also find it in the cockpit in the global account view.
<!-- image -->