> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getbifrost.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise setup

> Sign in to Bifrost CLI with Enterprise SSO, choose an assigned virtual key, and add a scoped management API key for administrative commands.

Enterprise SSO requires [User Provisioning](/enterprise/user-provisioning) to be configured, and the signed-in user needs an access profile or assigned virtual key. If you have not installed the CLI yet, see [Install the CLI](/quickstart/cli/getting-started#install-the-cli).

## Set up the CLI

**1. Add a context**

```bash theme={null}
bifrost context add production --base-url https://bifrost.example.com --use
```

**2. Sign in with Enterprise SSO**

```bash theme={null}
bifrost auth login
```

The CLI opens your browser to the Bifrost sign-in page, which uses your organization's identity provider. When sign-in completes, the terminal prints:

```text theme={null}
Signed in to https://bifrost.example.com as <you> using context "production".
Enterprise SSO now authorizes user-scoped inference. Management commands still require a management API key.
```

followed by the number of assigned virtual keys available to you.

If the browser cannot open, run `bifrost auth login --no-browser` and open the printed URL **on the same machine**. The sign-in callback listens on a local `127.0.0.1` port, so the flow cannot be completed from another device.

**3. Choose an assigned virtual key (optional)**

By default, the gateway applies your access profile or a default assigned key. To pin one of your assigned keys for this context:

```bash theme={null}
bifrost virtual-keys assigned
bifrost auth select-virtual-key <virtual-key-id>
```

`bifrost auth clear-selection` returns to the gateway default. An administrator can require a specific key, in which case only that key can be selected.

**4. Add a management API key (administrators)**

Skip this step if you only use the CLI for inference and coding agents.

1. In the Bifrost dashboard, go to **Settings → API Keys** and select **Create API Key**.
2. Choose scopes for the resources and operations the key needs. Setting an expiry is optional but recommended.
3. Copy the `bfst-*` key. It is shown only once.
4. Store it in the context:

```bash theme={null}
printf '%s\n' "$BIFROST_MANAGEMENT_KEY" | bifrost auth set-management-key --stdin
bifrost auth whoami
```

`bifrost auth whoami` lists the permissions the key holds.

**5. Verify**

```bash theme={null}
bifrost auth status --output json
bifrost models list
bifrost usage
```

In `auth status`, confirm `inference_credential_type` is `enterprise-sso` and, for administrators, `management_credential_type` is `management-api-key`.

## Management API key permissions

A management API key has only the permissions in its scopes; it does not inherit the creating user's role. You can grant only scopes you hold yourself, and a request outside the key's scopes fails with exit code `3`.

Grant the least access each workflow needs. Scopes are named by dashboard resource and operation, for example:

| Workflow | Scopes |
| - | - |
| List and inspect providers and credentials | `ModelProvider` → View |
| Create, rotate, or delete virtual keys | `VirtualKeys` → View, Create, Update, Delete |
| Reveal a virtual key's value | `VirtualKeys` → Reveal |
| Manage users and role assignments | `Users` → View, Update |
| Query inference logs | `Logs` → View |
| Manage management API keys | `APIKeys` → View, Create, Update, Delete |

## Session lifetime

An SSO access token is valid for one hour and refreshes automatically with a refresh token that is valid for 30 days and rotates on each use. If the refresh token expires or is revoked, commands fail with exit code `3`; run `bifrost auth login` again. `bifrost auth logout` revokes the session and removes the stored SSO and dashboard session credentials from the context.

## Next steps

> **[Coding agents](/quickstart/cli/coding-agents)**
>
> Launch Claude Code, Codex, OpenCode, or Gemini through Bifrost.

> **[Contexts and credentials](/quickstart/cli/contexts)**
>
> Work across environments and configure CI.

> **[Commands](/quickstart/cli/commands)**
>
> Inspect, query, and administer the gateway.

> **[User Provisioning](/enterprise/user-provisioning)**
>
> Connect your identity provider for Enterprise SSO.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.