CLI Reference

The aidin CLI provides developer tooling to authenticate with Aidin clusters, compile pipelines, build component container images, and register pipelines with Aidin Pipelines.

Global Syntax and Options

aidin [OPTIONS] COMMAND [ARGS]...

Option	Flag	Description
`--help`	`-h`	Show help message and exit.
`--version`		Show SDK version and exit (e.g. `aidin, version 0.4.0`).

Commands

`aidin login`

Authenticates with an upstream Authentik credential, exchanges it for a short-lived Kubernetes ServiceAccount token, and caches it locally.

aidin login --project <name> [OPTIONS]

Options

Option	Flag	Environment Variable	Default	Description
`--project`	`-p`	`KUBEFLOW_PROFILE`	(Required)	Aidin project name.
`--token`	`-t`	`AUTHENTIK_TOKEN`	`None`	Upstream Authentik bearer token.
`--token-stdin`			`False`	Read upstream token from standard input.
`--url`	`-u`	`TOKEN_EXCHANGER_URL`	`https://token-exchanger.<AIDIN_BASE_URL>`	URL of the Token Exchanger.
`--aidin-dir`		`AIDIN_USER_DIRECTORY`	`~/.aidin/`	Cache directory for credentials.
`--force-refresh`	`-f`		`False`	Force a new exchange even if a valid cached token exists.
`--no-verify-ssl`			`False`	Disable TLS certificate verification (unsafe).

[!WARNING] Passing tokens via -t/--token may expose sensitive credentials in process listings (ps) and shell history. Prefer using the AUTHENTIK_TOKEN environment variable or --token-stdin.

Examples

Standard login with environment variable:

export AUTHENTIK_TOKEN="ak_eyJhbGciOi..."
aidin login -p fraud-detection

Secure login via stdin pipe:

cat /run/secrets/authentik_token | aidin login -p fraud-detection --token-stdin

Reusing cached credentials:

# If a valid cached token exists within the clock-skew margin, no upstream token is required:
aidin login -p fraud-detection

Forcing a token refresh:

aidin login -p fraud-detection -f

`aidin logout`

Removes locally cached service tokens for a project.

aidin logout --project <name> [OPTIONS]

Options

Option	Flag	Environment Variable	Default	Description
`--project`	`-p`	`KUBEFLOW_PROFILE`	(Required)	Project/profile whose cached credentials will be removed.
`--aidin-dir`		`AIDIN_USER_DIRECTORY`	`~/.aidin/`	Credential cache directory.

Example

aidin logout -p fraud-detection
# Output: ✓ Removed cached credentials for project 'fraud-detection'.

`aidin compile`

Compiles a Python pipeline function into a KFP v2 YAML pipeline specification package, with optional automated container image compilation.

aidin compile [OPTIONS] PIPELINE [PACKAGE_PATH]

Arguments

PIPELINE: Target pipeline in module:function format (e.g. my_pipeline:pipeline_func or src/pipeline.py:ml_pipeline).
PACKAGE_PATH: Path to output YAML file (defaults to <function>.yaml or prompted in interactive mode).

Options

Option	Flag	Description
`--pipeline-name`	`-n`	Custom pipeline display name. Defaults to the function name.
`--no-type-check`		Disable KFP static type checking during compilation.
`--build`	`-b`	Build a unified Docker image containing project code and rewrite YAML image references.
`--build-root-directory`	`-d`	Root directory containing project source and `requirements.txt`.
`--build-registry`	`-r`	Target Docker/OCI registry (defaults to `harbor.aidin-ai.com/aidin-platform`).
`--non-interactive`		Run without interactive prompts, accepting provided arguments or defaults.

Interactive vs. Non-Interactive Mode

When run without --non-interactive, the CLI prompts for confirmation on isolated vs. unified images, output paths, and build directories:

Pipeline name [my-pipeline]:
Isolated components (Yes=independent, No=build unified image) [n]:
Build root directory [/home/user/project]:
Registry address [harbor.aidin-ai.com/aidin-platform]:
Output YAML file [my_pipeline.yaml]:

In CI/CD environments, always specify --non-interactive.

Examples

Basic compilation without image builds:

aidin compile my_pipeline:ml_pipeline pipeline.yaml --non-interactive

Compilation with container image build and push:

aidin compile my_pipeline:ml_pipeline pipeline.yaml \
  --build \
  -d . \
  -r harbor.aidin-ai.com/aidin-platform \
  --non-interactive

`aidin register`

Uploads and registers a compiled pipeline YAML to Aidin Pipelines using the project’s valid cached service token.

aidin register [OPTIONS] PIPELINE_YAML

Arguments

PIPELINE_YAML: Path to the compiled YAML pipeline file.

Options

Option	Flag	Environment Variable	Default	Description
`--name`	`-n`		(Required)	Pipeline name to display in Aidin Pipelines.
`--project`	`-p`	`KUBEFLOW_PROFILE`	(Required)	Aidin project name.
`--pipeline-server-url`	`-s`	`PIPELINE_SERVER_URL`	`https://pipeline-server.<AIDIN_BASE_URL>`	Aidin Pipelines API server URL.
`--aidin-dir`		`AIDIN_USER_DIRECTORY`	`~/.aidin/`	Credential cache directory.
`--no-verify-ssl`			`False`	Disable TLS certificate verification.

[!NOTE] aidin register retrieves the active cached service token from ~/.aidin/<project>/token.json. If no token exists or if the token is expired (taking the 60-second skew buffer into account), the command fails with an actionable message prompting you to run aidin login.

Example

aidin register pipeline.yaml -n "Fraud Detection v1" -p fraud-detection

Expected output:

✓ Pipeline registered successfully.
  ID:      a92f81bc-5612-421b-873b-bce98c172401
  Name:    Fraud Detection v1
  Project: fraud-detection

Environment Variables Reference

Variable	Description	Default
`AUTHENTIK_TOKEN`	Upstream Authentik user or service token	`None`
`KUBEFLOW_PROFILE`	Default Aidin project name	`None`
`AIDIN_BASE_URL`	Cluster base domain	`platform.aidin-ai.com`
`TOKEN_EXCHANGER_URL`	Full URL of the Token Exchanger service	`https://token-exchanger.<AIDIN_BASE_URL>`
`PIPELINE_SERVER_URL`	Full URL of the Aidin Pipelines API	`https://pipeline-server.<AIDIN_BASE_URL>`
`AIDIN_USER_DIRECTORY`	Local base directory for token caching	`~/.aidin/`
`COMPS_BASE_IMAGE`	Default container base image for components	`python:3.11`

Next Steps

Review the Python API Reference for programmatic compilation and client usage.
Learn about the Authentication Lifecycle.