Environment Variables for Globus CLI
This document covers the various environment variables with special meanings for the Globus CLI.
Globus SDK Variables
The CLI supports all of the environment variables which can be used to configure the Globus SDK.
For the most part, CLI users will not need to modify these values. However, for
the particular case of
GLOBUS_SDK_ENVIRONMENT, the CLI has special additional
When the environment is set, as in
GLOBUS_SDK_ENVIRONMENT="preview", the CLI
will isolate any credentials used for login and session management.
globus logout, and other commands will operate in the context
of the "preview" environment, for example.
Interactivity with GLOBUS_CLI_INTERACTIVE
Certain features of the CLI will be enabled or disabled based on whether or not the terminal session used to run it is detected as interactive or not. For example, additional usage hints may be printed to stderr in an interactive terminal.
However, it is possible for the interctivity adetection to be fooled. For example, an automated tool which emulates a login shell may appear interactive even though it is not.
To control these behaviors, the CLI allows users to explicitly specify whether
or not the shell is interactive. Use
GLOBUS_CLI_INTERACTIVE=0 to set
"not interactive", and
GLOBUS_CLI_INTERACTIVE=1 to set "yes, interactive".
Profile-switching with GLOBUS_PROFILE
The Globus CLI allows users to login, logout, and perform various other authentication- and authorization-related activities. Until version 3, however, the only way to switch to another Globus Account was to logout and login again.
Starting in version 3, the Globus CLI respects a new variable,
GLOBUS_PROFILE, which names the "profile", or set of credentials, which the
GLOBUS_PROFILE variable is not set, a default profile is used. Any
string value which is assigned to the profile variable acts as an alternative
For example, one could setup the default profile and a profile named
$ globus login ... # login as email@example.com $ export GLOBUS_PROFILE=bar $ globus login ... # login as firstname.lastname@example.org
unset GLOBUS_PROFILE will allow the user to act as
export GLOBUS_PROFILE=bar will allow the user to switch back to
Switching between accounts using
GLOBUS_PROFILE is a way of keeping them
unlinked, meaning that the user has multiple identities which are isolated
into separate accounts. This is not the same as having multiple identities
which are linked into a single Globus Account.
Client Credentials with GLOBUS_CLI_CLIENT_ID
New in Globus CLI version 3.2!
The Globus CLI supports use of client credentials for login, if you have registered a client.
To use client credentials, you must set
GLOBUS_CLI_CLIENT_ID to your client
GLOBUS_CLI_CLIENT_SECRET to your client secret. You may then use
globus commands as normal, with no need to run
For example, with an ID of
b0500dab-ebd4-430f-b962-0c85bd43bdbb and a secret
$ export GLOBUS_CLI_CLIENT_ID="b0500dab-ebd4-430f-b962-0c85bd43bdbb" $ export GLOBUS_CLI_CLIENT_SECRET="ABCDEFGHIJKLMNOP0123456789=" $ globus whoami email@example.com
globus login is not allowed with client credentials,
still has an effect.
logout will clean up any cached credentials for the