feat(ENG-15089): deprecate cloudsmith login and handle the password login switch-off by BartoszBlizniak · Pull Request #489 · cloudsmith-io/cloudsmith-cli

BartoszBlizniak · 2026-10-16T13:57:33Z

Description

Cloudsmith is disabling username and password login (POST /v1/user/token/), which cloudsmith login and its cloudsmith token alias depend on.

While the endpoint works, both commands keep working and print a deprecation warning on stderr before the prompt:

Warning: `cloudsmith login` is deprecated and will stop working when Cloudsmith disables username and password login. The date will be announced at https://cloudsmith.com/changelog
Use an API key or SAML instead: set `CLOUDSMITH_API_KEY` to an API key from the Cloudsmith web app (your user menu, then Personal API Keys), or run `cloudsmith auth --workspace <workspace>` to log in with SAML.
More: https://docs.cloudsmith.com/developer-tools/cli#getting-your-api-key

Once the server returns 410 (or 404 after the route is deleted), they fail with a clear message and the same fix, instead of a raw error. Other errors, such as outages, are unchanged.
The 401 hints no longer tell users to run cloudsmith token.

Type of Change

Additional Notes

This deprecates the commands instead of removing them (#447), since they still work today. Because the CLI reacts to the server's response, it needs no further release when the endpoint is disabled. #447 can follow as cleanup.

To try the switch-off path, point --api-host at any server that answers POST /user/token/ with a 410.

🤖 Generated with Claude Code

Copilot

🟢 Approval recommended

Static review identified no blocking issues in the deprecation flow, error handling, or output routing; tests were not executed.

0 open findings

What changed in this PR

Deprecates password-based login without removing working commands, preparing the CLI for the server-side shutdown.

Changes:

Adds deprecation warnings and actionable messages for 404/410 responses.
Keeps config messages off JSON stdout and updates authentication hints.
Adds regression tests and documents API key alternatives.

File	Description
README.md	Documents deprecation and API key alternatives.
cloudsmith_cli/core/tests/test_config.py	Tests config output routing in JSON modes.
cloudsmith_cli/core/config.py	Routes config prompts and messages to stderr in JSON modes.
cloudsmith_cli/cli/tests/test_exceptions.py	Tests updated authentication hints.
cloudsmith_cli/cli/tests/commands/test_login.py	Tests warnings, shutdown responses, and JSON output.
cloudsmith_cli/cli/exceptions.py	Updates login and authentication error hints.
cloudsmith_cli/cli/commands/login.py	Adds warnings and handles endpoint shutdown responses.
CHANGELOG.md	Records deprecation and output fixes.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

🟢 Approval recommended

The focused changes have regression coverage, and no blocking issues were identified.

0 open findings

🧠 Review effort: Balanced

Copilot

🟢 Approval recommended

No blocking issues were identified, and focused regression tests cover the changed behavior, though tests were not executed.

0 open findings

🧠 Review effort: Balanced

`cloudsmith login` and its `cloudsmith token` alias now print a deprecation warning on stderr before they prompt for credentials. The commands keep working until username and password login is disabled. The warning points users at getting an API key from the web app and at `cloudsmith auth`. The 401 hint for users with no credentials no longer recommends `cloudsmith token`, and the failed-login hint now covers the `login` name as well as `token`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…clean When the API returns 410 (or 404 once the route is removed), `cloudsmith login` and `cloudsmith token` explain that username and password login is disabled and how to get an API key, instead of the raw error. Other errors, such as outages or wrong credentials, keep the standard rendering. Config file prompts and messages from `create_config_files` and `new_config_messaging` now go to stderr for JSON output, so `login -F json` and `--save-config` with JSON output produce parseable stdout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

… date The warning, help text, CHANGELOG and README say the commands stop working when username and password login is disabled, and that the date will be announced in the public changelog. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- The deprecation warning uses a `Warning:` prefix and names the replacement. - The disabled-login error states what failed and adds a `Fix:` line with the exact command. - Use "API key" consistently, and stop telling users to "try again" in the 401 hints. The success output (`Your API key/token is: ...`) is unchanged so that scripts parsing it keep working. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The deprecation warning, the disabled-login error and `--help` now end with a `More:` line linking to the CLI docs section on getting an API key. The SSO fix names the exact command, `cloudsmith auth --workspace <workspace>`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Keep this change to the login deprecation. Routing config file prompts and messages to stderr for JSON output is a separate fix, so restore `core/config.py` and its tests, and drop the CHANGELOG entry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…sernamepassword-flow

cloudsmith-iduffy · 2026-10-19T08:26:59Z

@copilot please get rid of sso mentions. It should always just be saml.

Never sso, never saml sso, just simply saml.

Co-authored-by: cloudsmith-iduffy <178375997+cloudsmith-iduffy@users.noreply.github.com>

Copilot · 2026-10-19T08:31:31Z

@copilot please get rid of sso mentions. It should always just be saml.

Never sso, never saml sso, just simply saml.

Updated the login/token warnings, help, removal messages, and 401 hints to use SAML only in 15eee57. Added regression assertions; all 35 focused tests and Ruff checks pass.

Restore the original wording of the failed-login 401 hint; only the `login` name is added so it no longer suggests the command that just failed. Say "SAML" instead of "SSO" in the CHANGELOG entries. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…cate-cloudsmith-login-usernamepassword-flow # Conflicts: # CHANGELOG.md

BartoszBlizniak · 2026-10-19T10:14:09Z

Waiting for product to see if we can provide a more accurate date before merging.

…cate-cloudsmith-login-usernamepassword-flow # Conflicts: # CHANGELOG.md

…sernamepassword-flow

BartoszBlizniak requested a balanced review from Copilot October 16, 2026 13:57

Copilot started reviewing on behalf of BartoszBlizniak October 16, 2026 13:58

View session

Copilot AI reviewed Oct 16, 2026

View reviewed changes

BartoszBlizniak requested a balanced review from Copilot October 16, 2026 14:00

Copilot started reviewing on behalf of BartoszBlizniak October 16, 2026 14:01

View session

Copilot AI reviewed Oct 16, 2026

View reviewed changes

BartoszBlizniak requested a balanced review from Copilot October 16, 2026 14:39

Copilot started reviewing on behalf of BartoszBlizniak October 16, 2026 14:40

View session

Copilot AI reviewed Oct 16, 2026

View reviewed changes

BartoszBlizniak and others added 5 commits October 16, 2026 15:51

BartoszBlizniak force-pushed the eng-15089-cli-deprecate-cloudsmith-login-usernamepassword-flow branch from 7800fe7 to 2c8e02b Compare October 16, 2026 14:51

BartoszBlizniak and others added 2 commits October 16, 2026 15:59

Merge branch 'master' into eng-15089-cli-deprecate-cloudsmith-login-u…

10a3914

…sernamepassword-flow

cloudsmith-iduffy mentioned this pull request Oct 16, 2026

fix: replace login and token commands with a removal notice #447

Closed

2 of 6 tasks

cloudsmith-iduffy approved these changes Oct 16, 2026

View reviewed changes

Merge branch 'master' into eng-15089-cli-deprecate-cloudsmith-login-u…

4337462

…sernamepassword-flow

BartoszBlizniak marked this pull request as ready for review October 19, 2026 08:00

BartoszBlizniak requested a review from a team as a code owner October 19, 2026 08:00

cloudsmith-iduffy approved these changes Oct 19, 2026

View reviewed changes

Comment thread cloudsmith_cli/cli/commands/login.py Outdated

Comment thread cloudsmith_cli/cli/commands/login.py Outdated

Comment thread cloudsmith_cli/cli/exceptions.py

Comment thread cloudsmith_cli/cli/exceptions.py Outdated

Comment thread cloudsmith_cli/cli/exceptions.py Outdated

Copilot started work on behalf of cloudsmith-iduffy October 19, 2026 08:27

View session

fix: standardize login authentication messages on SAML

15eee57

Co-authored-by: cloudsmith-iduffy <178375997+cloudsmith-iduffy@users.noreply.github.com>

Copilot AI requested a review from cloudsmith-iduffy October 19, 2026 08:31

Copilot finished work on behalf of cloudsmith-iduffy October 19, 2026 08:32

Merge remote-tracking branch 'origin/master' into eng-15089-cli-depre…

6a5c6d0

…cate-cloudsmith-login-usernamepassword-flow # Conflicts: # CHANGELOG.md

BartoszBlizniak and others added 2 commits October 19, 2026 13:16

Merge remote-tracking branch 'origin/master' into eng-15089-cli-depre…

043fe1e

…cate-cloudsmith-login-usernamepassword-flow # Conflicts: # CHANGELOG.md

Merge branch 'master' into eng-15089-cli-deprecate-cloudsmith-login-u…

057a15d

…sernamepassword-flow

Navigation Menu

Repository navigation

feat(ENG-15089): deprecate cloudsmith login and handle the password login switch-off - #489

feat(ENG-15089): deprecate cloudsmith login and handle the password login switch-off#489
BartoszBlizniak wants to merge 13 commits into
masterfrom
eng-15089-cli-deprecate-cloudsmith-login-usernamepassword-flow

BartoszBlizniak commented Oct 16, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cloudsmith-iduffy commented Oct 19, 2026

Uh oh!

Copilot AI commented Oct 19, 2026

Uh oh!

BartoszBlizniak commented Oct 19, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

Conversation

BartoszBlizniak commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of Change

Additional Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cloudsmith-iduffy commented Oct 19, 2026

Uh oh!

Copilot AI commented Oct 19, 2026

Uh oh!

BartoszBlizniak commented Oct 19, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

BartoszBlizniak commented Oct 16, 2026 •

edited

Loading