Use the Confluent Cloud CLI with multiple credentials

You can provide restricted access to Confluent Cloud resources via the CLI by using the ccloud init command. This command allows you to authenticate with Confluent Cloud using as an Apache Kafka® API key and secret pair instead of a :ref:<user-account>.

Each authentication instance that you create is saved.


When you connect to a cluster using ccloud init with the --kafka-auth option, you are limited to produce and consume. Topic management is not supported.

  1. Create and log in to your environment by using the ccloud init command, where <context-name> is your environment name. This requires a Kafka API key and the bootstrap server URL of the Confluent Cloud environment.


    Context here is basically the combination of a user and a server. For example, each of the following can be considered a different context:

    • Jane <> https://localhost:8090
    • David <> https://localhost:8090
    • David <> https://test-env:8090

    Changing contexts is useful when you must switch back and forth between multiple CLI users, such as a super user and some other user with limited capabilities as defined by their RBAC role.

    There are two Confluent Cloud CLI commands available to configure context:

    • To select and configure an already-existing context, use the ccloud config context command.
    • To create a new context, use the ccloud init command when logging in to the Confluent Cloud CLI, as shown below. You must use a Kafka API key and secret for produce and/or consume (rather than your Confluent Cloud user credentials).
    ccloud init <context-name> --kafka-auth

    You should be prompted to enter the login information:

    Bootstrap: xxx
    API Key: xxx
    API Secret: xxx
  2. You can now produce or consume to your Confluent Cloud environment. For more information, see ccloud kafka topic consume.