Mint and print a bearer token for the selected Azure AI Foundry resource, for scripts, curl calls, or pasting into a browser tool.
pks foundry token [options]$ pks foundry tokenPrint a token for the default cognitive-services scope
$ pks foundry token --scope https://management.azure.com/.defaultRequest a management-plane token instead
$ TOKEN=$(pks foundry token)Capture the token non-interactively
Get a bearer token for the Azure AI Foundry resource you selected, so a script or a manual HTTP call can talk to the endpoint directly. The command refreshes the stored credential first, so the token it prints is fresh.
pks foundry init. Without stored credentials the command exits with a pointer back to pks foundry init.pks foundry token
The token prints and pks waits for a keypress. Press c to copy it to the clipboard. Copying is best effort: it shells out to xclip, xsel, or wl-copy on Linux, pbcopy on macOS, and clip on Windows, and is silently skipped when none is available.
TOKEN=$(pks foundry token)
When stdout is redirected or piped, the command writes the raw value and returns immediately, with no keypress wait. That makes it safe inside scripts and command substitution.
The default scope is https://cognitiveservices.azure.com/.default, the data plane for the Foundry resource. To get a management-plane token instead:
pks foundry token --scope https://management.azure.com/.default
--json does not print readable JSON. It builds a payload of the token, endpoint, model, resource, and subscription, gzip-compresses it, and base64-encodes the result. The intended consumer is a browser tool that decodes it with pako.ungzip.
pks foundry token --json
Piping this straight into jq will not work. Base64-decode and gunzip it first.
pks foundry status
Confirm the endpoint and default model the token belongs to before using it against an API.
| Flag | Default | Description |
|---|---|---|
-s, --scope <scope> | https://cognitiveservices.azure.com/.default | Azure token scope to request. |
--json | false | Emit a gzip-compressed, base64-encoded payload with token, endpoint, and default model. |
-v, --verbose | false | Enable verbose output. |
"Not authenticated". No stored credentials. Run pks foundry init.
Token refresh fails. The stored refresh token is expired or revoked. Run pks foundry init --force to sign in again.
Pressing c does nothing. No clipboard helper was found on the machine. Redirect the output instead: pks foundry token > token.txt.
jq cannot parse --json output. That output is compressed and base64-encoded by design. Use the plain form, pks foundry token, when you want a raw token in a shell.
A 401 from Azure with a valid-looking token. Check the scope. A cognitive-services token is rejected by management-plane APIs and the reverse.