CloudQuery CLI 6.42.0 - Platform Token Login

CloudQuery CLI cli-v6.42.0 was published on 2 September 2026. The tag is stable, not a prerelease. The change that matters for ELT operators is that cloudquery login now accepts a CloudQuery Platform token from the browser callback instead of treating every callback token as a Hub refresh token.

The full release notes and downloads are on the GitHub release page.

Direct tenant login with --host ¶

cloudquery login still opens a browser and waits on a loopback /callback. Until this tag, that handler always saved the token query param as a Hub refresh token and sent the browser to the accounts success page.

Pull request 23259 in commit 74a1f0d splits the path in cli/cmd/login.go. A token whose prefix is cqpd_ is a platform token. The CLI writes it with platform.SavePlatformToken, removes any Hub refresh token, and sets team from the token tm claim. It also writes team_internal as false. Other tokens still take the Hub path, and that path now calls platform.RemovePlatformToken first so the two stores stay exclusive.

--host skips email based routing:

cloudquery login --host my-tenant.mycloudquery.com

The CLI opens https://<host>/auth/login?cliReturnTo=<loopback>/callback. If the host already includes a scheme, that scheme is kept, which is how a local http://localhost:3000 tenant is tested.

--team is still there. If you pass --team and the platform token belongs to a different team, platformLoginTeam returns an error before any credential file is written. An empty tm claim clears a stale team value left by a previous Hub login.

Platform tokens persist at cloudquery/platform_token through config.SaveDataString. IsPlatformToken is a prefix check only. cli/internal/platform/inject.go now reads that store last in platformToken(). Order is CQ_PLATFORM_TOKEN, then a cqpd_ value in CLOUDQUERY_API_KEY, then the saved file. Headless jobs should keep using env vars. Browser login fills the lowest slot.

The callback also reads origin for the success page. That param arrives on a loopback URL anyone can open, so tenantSuccessURL only trusts a bare https origin, or http on localhost or a loopback IP. Paths, query strings, fragments, and http on a public host are rejected. Rejected origins get a plain text page that says you are signed in. If origin is set and not trusted, the CLI also prints a warning on stderr.

Hub tokens still redirect to the accounts /success-close page. cloudquery logout now calls platform.RemovePlatformToken after the usual auth cleanup.

The saved token is then available to later CLI work that already consumed env based cqpd_ credentials: plugin download auth via DownloadAuth, and platform destination injection. Tenant URL comes from the u claim. Team comes from tm. The CLI does not verify the token signature locally. The platform still authenticates it on the wire.

The rest of the tag is dependency pins listed as bug fixes.

github.com/cloudquery/plugin-sdk/v4 moves from v4.96.2 to v4.96.3. github.com/cloudquery/plugin-pb-go is at v1.27.18. Those modules sit on the CLI to plugin gRPC path. This is a patch pin, not a protocol rewrite. The previous CLI tag already spent most of its notes on SDK and OTEL pins. This bump is a follow on, not a new telemetry story.

golang.org/x/net is at v0.58.0. The login callback and plugin fetches use that HTTP stack.

github.com/santhosh-tekuri/jsonschema/v6 is at v6.0.3. Spec files still go through that validator.

github.com/yuin/goldmark v1.8.5 and the golang.org/x/exp digest e88cd73 are parser and helper pins. They do not change sync semantics.

The notes list no breaking change and no migration step. Operators who only run Hub login and never set --host keep the old flow.