How to set up the Nebius AI Cloud CLI

To configure the Nebius AI Cloud CLI, use one of the authorization options:

A user account offers personalized access and accountability. It can be used when you, as a human user, need to manage and interact with resources.
A service account automates the interaction of applications and services with resources.

Authorizing with a user account

To authorize quickly, follow the non-interactive flow. To control the authorization process, follow the interactive flow.

Non-interactive flow
Interactive flow

Open your terminal.
Create a name of your new profile in the Nebius AI Cloud CLI and save it to an environment variable:
```
export PROFILE_NAME=<new-profile-name>
```
Get the project ID and save it to an environment variable:
```
export PROJECT_ID=<project_ID>
```
Run the following command:
```
nebius profile create \
  --profile $PROFILE_NAME \
  --endpoint api.nebius.cloud \
  --federation-endpoint auth.nebius.com \
  --parent-id $PROJECT_ID
```
If you have access to multiple tenants, you can specify the tenant that you want to use with this profile in the --tenant-id parameter. If you are added to someone else’s tenant and know the ID of its federation, you can specify it either in the --federation-id parameter, or when logging in to the Nebius AI Cloud web console after running the command.
In the browser tab that opens, log in to the web console if prompted. After logging in (or if you have already been logged in), you will see the following message:
```
Login is successful, you may close the browser tab and go to the console
```
Close the browser tab and go back to your terminal window. You will see the following message:
```
Profile "<profile-name>" configured and activated
```
Check that your new profile has been created and set as the default one:
```
nebius profile list
```
You should see the following output:
```
default
<profile-name> [default]
```

Open your terminal.
Run the following command:
```
nebius profile create
```
Set up the new profile:
1. Using arrow keys, select Create a new profile and press Enter.
2. Specify the profile name and press Enter.
3. Keep the default value for Select api endpoint (api.nebius.cloud) and press Enter.
4. Under Select authorization type, keep federation and press Enter.
5. Keep the default value for Select federation endpoint (auth.nebius.com) and press Enter.
6. In the browser tab that opens, log into the Nebius AI Cloud web console if prompted. After logging in (or if you have already been logged in), you will see the following message:
  Login is successful, you may close the browser tab and go to the console
7. Close the browser tab and go back to your terminal window. If you have access to multiple tenants, the CLI will prompt you to choose a tenant ID. Choose the tenant that you want to use. If you only have access to one tenant, it is selected by default. You will see the following message:
  Profile "<profile-name>" configured and activated
Check that your new profile has been created and set as the default one:
```
nebius profile list
```
You should see the following output:
```
default
<profile-name> [default]
```
Get the project ID and add it to the CLI configuration:
```
nebius config set parent-id <project_ID>
```

Authorizing with a service account

Before authorization, create a service account. You can do it using a user account or another service account within a group that has the admin role within your tenant; for example, the default admins group. You can check this in the Administration → IAM section of the web console. To authorize quickly, follow the non-interactive flow. To control the authorization process, follow the interactive flow.

Non-interactive flow
Interactive flow

Open the service account page in the web console.
Open your terminal.

Save the service account details to environment variables:

export SA_ID=<service-account-id>
export PUBLIC_KEY_ID=<...>
export PRIVATE_KEY_PATH=<...>

Create a name for your profile and save it to an environment variable:
```
export SA_PROFILE_NAME=<...>
```
For example, gpu-monitoring-sa.
Use one profile per projectCreate a separate Nebius AI Cloud CLI profile for each project to ensure correct region-specific configuration.
Get the project ID and save it to an environment variable:
```
export PROJECT_ID=<project_ID>
```

Run the following command:

nebius profile create \
  --endpoint api.nebius.cloud \
  --service-account-id $SA_ID \
  --public-key-id $PUBLIC_KEY_ID \
  --private-key-file $PRIVATE_KEY_PATH \
  --profile $SA_PROFILE_NAME \
  --parent-id $PROJECT_ID

You will see the following message:

Profile "<profile-name>" configured and activated

Check that your new profile has been created and set as the default one:
```
nebius profile list
```
You should see the following output:
```
default
<profile-name> [default]
```

Open the service account page in the web console.
Open your terminal.
Run the following command:
```
nebius profile create
```
Use the arrow keys to select Create a new profile, then press Enter.
Use one profile per projectCreate a separate Nebius AI Cloud CLI profile for each project to ensure correct region-specific configuration.
Add a profile name and press Enter.
Keep the default value for Select api endpoint (api.nebius.cloud) and press Enter.
Under Select authorization type, choose service account and press Enter.
Under Set service account ID, paste the Service account ID from the web console.
Under Set public key ID, paste the Public key ID from the web console.
Under Set path to PEM encoded private key, specify the path to your private key in PEM format. You will see the following message:
```
Profile "<profile-name>" configured and activated
```
Check that your new profile has been created and set as the default one:
```
nebius profile list
```
You should see the following output:
```
default
<profile-name> [default]
```
Get the project ID and add it to the CLI configuration.
```
nebius config set parent-id <project_ID>
```

​Authorizing with a user account

​Authorizing with a service account

Authorizing with a user account

Authorizing with a service account