# atmos azure aks token

Generate a short-lived AKS bearer token for kubectl authentication. This command is designed as a kubectl exec credential plugin and is automatically configured in kubeconfig files generated by `atmos azure aks update-kubeconfig`.

## Usage

```shell
atmos azure aks token --cluster-name <name> --resource-group <resource_group> [flags]
```

## Examples

```shell
# Generate token for a cluster (typically called by kubectl automatically)
atmos azure aks token --cluster-name my-cluster --resource-group my-rg

# Generate token using a specific identity
atmos azure aks token --cluster-name my-cluster --resource-group my-rg --identity azure-dev

# Test token generation manually
atmos azure aks token --cluster-name dev-cluster --resource-group dev-rg | jq .
```

## Arguments

- **n/a**
  No positional arguments.

## Flags

- **`--cluster-name` (required)**

  The name of the AKS cluster to generate a token for.
- **`--resource-group` (required)**

  The Azure resource group containing the AKS cluster.
- **`--subscription-id` (optional)**

  Azure subscription ID, used for logging/diagnostics. Not required for token generation itself.
- **`--identity` (alias `-i`)**

  Identity name to authenticate with for token generation. If omitted, Atmos uses the default identity (single identity auto-selected) or the `ATMOS_IDENTITY` environment variable.

## How It Works

This command outputs an already-acquired AAD access token as a Kubernetes `ExecCredential` JSON object — no external tool (`kubelogin`, `az`) is required:

1. Atmos authenticates the specified identity.
2. Azure AD access tokens are scope-bound at issuance (unlike AWS SigV4 signing), so the identity's provider (device-code, OIDC, or Azure CLI) acquires an additional token scoped to the AKS-managed AAD server application at authentication time, alongside the identity's primary ARM token.
3. This command reads that already-acquired, AKS-scoped token from the credential and returns it.

### ExecCredential Output

```json
{
  "apiVersion": "client.authentication.k8s.io/v1beta1",
  "kind": "ExecCredential",
  "status": {
    "expirationTimestamp": "2026-01-15T12:15:00Z",
    "token": "eyJ0eXAiOiJKV1Qi..."
  }
}
```

### Kubeconfig Integration

When you run `atmos azure aks update-kubeconfig`, Atmos automatically generates a kubeconfig entry that uses this command as an exec credential plugin:

```yaml
users:
  - name: atmos-aks-dev-cluster-dev-rg
    user:
      exec:
        apiVersion: client.authentication.k8s.io/v1beta1
        command: atmos
        args:
          - azure
          - aks
          - token
          - --cluster-name
          - dev-cluster
          - --resource-group
          - dev-rg
          - --identity=azure-dev
```

This means kubectl automatically calls `atmos azure aks token` whenever it needs a fresh token, providing seamless authentication without manual token management.

## Notes

- This command is designed to be called by kubectl, not manually.
- The command suppresses usage errors since kubectl invokes it automatically.
- Only clusters using AKS-managed AAD (the modern default) are supported. Clusters that expect a non-default AAD server application log a warning during `update-kubeconfig` since the token may not be accepted.

## See Also

- [Auth Login Command](/cli/commands/auth/login) — Authenticate with identities and auto-provision kubeconfig
- [Azure AKS Update Kubeconfig](/cli/commands/azure/aks/update-kubeconfig) — Download kubeconfig from AKS clusters
- [Auth Configuration](/cli/configuration/auth) — Configure providers, identities, and integrations