DS Plane CLI
DS Plane CLI

Reference

Configuration and authentication

Understand DS Plane landscape storage, JWT handling, configuration paths, and authentication fallback behavior.

DS Plane stores non-secret landscape configuration in a platform-specific configuration directory. It prefers your operating system’s credential service for JWTs.

Configuration directories

Platform Directory
Linux and macOS $XDG_CONFIG_HOME/dsplane
Unix fallback ~/.config/dsplane
Windows %APPDATA%\dsplane

On Linux and macOS, XDG_CONFIG_HOME must be an absolute path. DS Plane ignores a relative value and uses ~/.config instead.

The directory can contain:

File Purpose
landscape-config.json Normalized landscape URLs and explicitly approved plaintext JWTs.
devspaces.json Per-Dev Space prompts and local connection preferences.
user.json Local user metadata used by the CLI.

Landscape URL normalization

DS Plane accepts HTTP and HTTPS landscape URLs. It stores only the origin:

https://example.applicationstudio.cloud.sap/

Paths, query strings, and fragments are removed. Other URL schemes are rejected.

Browser authentication

When you confirm browser login, DS Plane opens:

<landscape-origin>/ext-login.html

The landscape posts the JWT to:

http://127.0.0.1:55532/ext-login

The callback listener closes after receiving a token, timing out, or cancelling the login attempt. The timeout is 180 seconds.

Manual JWT entry

If the browser does not return a token, DS Plane displays the landscape’s /jwt URL. Open it in an authenticated browser, copy the token, and paste it into the TUI.

Credential persistence

DS Plane uses Bun’s system secrets API with the service name:

com.github.danielnappa.dsplane

The landscape origin is the credential name.

If no system credential backend is available, DS Plane offers two choices:

  • Save the JWT in landscape-config.json with file mode 0600 where supported.
  • Keep the JWT in memory for the current process only.

Plaintext storage is an explicit fallback. Anyone who can read your user-data file can use the stored JWT until it expires.

Saved-token behavior

DS Plane reuses a saved JWT only when it passes local validity checks. An absent, malformed, or expired token returns you to the authentication prompt.

Deleting a landscape removes its session token, stored credential, and landscape entry.