[CP-768] feat(auth): add login with endpoint-inferred Auth0 issuer

cmd/qcloud/main.go

@@ -29,6 +29,10 @@ func main() {
 	cmd.SetContext(ctx)
 	if err := cmd.Execute(); err != nil {
 		fmt.Fprintln(os.Stderr, err)
+		if hint := cli.ErrorHint(err); hint != "" {
+			fmt.Fprintln(os.Stderr, hint)
+		}
+
 		os.Exit(1)
 	}
 }

docs/reference/qcloud.md

@@ -6,8 +6,12 @@ Qdrant Cloud CLI
 
 The command-line interface for Qdrant Cloud.
 
-Get started:
+Get started — choose one of:
+
+  qcloud auth login
   qcloud context set default --api-key <KEY> --account-id <ID>
+
+Then:
   qcloud cluster list
 
 Documentation: https://github.com/qdrant/qcloud-cli
@@ -29,6 +33,7 @@ Documentation: https://github.com/qdrant/qcloud-cli
 ### SEE ALSO
 
 * [qcloud account](qcloud_account.md)	 - Manage Qdrant Cloud accounts
+* [qcloud auth](qcloud_auth.md)	 - Log in to Qdrant Cloud with a browser
 * [qcloud backup](qcloud_backup.md)	 - Manage Qdrant Cloud backups
 * [qcloud cloud-provider](qcloud_cloud-provider.md)	 - Manage cloud providers
 * [qcloud cloud-region](qcloud_cloud-region.md)	 - Manage cloud regions

docs/reference/qcloud_auth.md

@@ -0,0 +1,61 @@
+## qcloud auth
+
+Log in to Qdrant Cloud with a browser
+
+### Synopsis
+
+Log in to Qdrant Cloud with a browser (or a device code) instead of pasting an API key.
+
+The login host is not a separate flag. It is derived from the gRPC
+endpoint (flag --endpoint, env QDRANT_CLOUD_ENDPOINT, or the active context):
+
+  grpc.cloud.qdrant.io:443  →  login.cloud.qdrant.io
+
+When OAuth is enabled, the gateway also advertises the issuer at the
+unauthenticated URL https://api.cloud.qdrant.io/.well-known/oauth-protected-resource.
+That document wins over hostname inference.
+
+After login, API calls send Authorization: Bearer <token>. Management API keys
+keep working unchanged when --api-key / QDRANT_CLOUD_API_KEY is set.
+
+### Examples
+
+```
+# Discover the login URL for the current endpoint
+qcloud auth discover
+
+# Browser login (authorization code + PKCE on 127.0.0.1)
+qcloud auth login
+
+# Device code (SSH / no browser)
+qcloud auth login --device --scope read-only
+```
+
+### Options
+
+```
+  -h, --help   help for auth
+```
+
+### Options inherited from parent commands
+
+```
+      --account-id string    Qdrant Cloud Account ID (env: QDRANT_CLOUD_ACCOUNT_ID)
+      --api-key string       Management API Key (env: QDRANT_CLOUD_API_KEY)
+  -c, --config string        Config file path (env: QDRANT_CLOUD_CONFIG, default ~/.config/qcloud/config.yaml)
+      --console-url string   Qdrant Cloud web console base URL (env: QDRANT_CLOUD_CONSOLE_URL, default https://cloud.qdrant.io)
+      --context string       Override the active context (env: QDRANT_CLOUD_CONTEXT)
+      --debug                Enable debug logging to stderr
+      --endpoint string      gRPC API endpoint (env: QDRANT_CLOUD_ENDPOINT, default grpc.cloud.qdrant.io:443)
+      --json                 Output as JSON
+```
+
+### SEE ALSO
+
+* [qcloud](qcloud.md)	 - Qdrant Cloud CLI
+* [qcloud auth discover](qcloud_auth_discover.md)	 - Show the OAuth login URL inferred from the API endpoint
+* [qcloud auth login](qcloud_auth_login.md)	 - Log in with a browser or device code
+* [qcloud auth logout](qcloud_auth_logout.md)	 - Log out and drop stored OAuth tokens
+* [qcloud auth status](qcloud_auth_status.md)	 - Show OAuth login status for the current endpoint
+* [qcloud auth token](qcloud_auth_token.md)	 - Print a fresh OAuth access token (sensitive)
+

docs/reference/qcloud_auth_discover.md

@@ -0,0 +1,47 @@
+## qcloud auth discover
+
+Show the OAuth login URL inferred from the API endpoint
+
+### Synopsis
+
+Print the OAuth API resource and authorization-server issuer for the current endpoint.
+
+The gRPC endpoint (default grpc.cloud.qdrant.io:443) is turned into
+https://api.cloud.qdrant.io. The CLI then GETs
+/.well-known/oauth-protected-resource with no credentials. If the gateway
+returns authorization_servers, that issuer is used; otherwise
+login.cloud.qdrant.io is inferred. No client id is required.
+
+```
+qcloud auth discover [flags]
+```
+
+### Examples
+
+```
+qcloud auth discover
+```
+
+### Options
+
+```
+  -h, --help   help for discover
+```
+
+### Options inherited from parent commands
+
+```
+      --account-id string    Qdrant Cloud Account ID (env: QDRANT_CLOUD_ACCOUNT_ID)
+      --api-key string       Management API Key (env: QDRANT_CLOUD_API_KEY)
+  -c, --config string        Config file path (env: QDRANT_CLOUD_CONFIG, default ~/.config/qcloud/config.yaml)
+      --console-url string   Qdrant Cloud web console base URL (env: QDRANT_CLOUD_CONSOLE_URL, default https://cloud.qdrant.io)
+      --context string       Override the active context (env: QDRANT_CLOUD_CONTEXT)
+      --debug                Enable debug logging to stderr
+      --endpoint string      gRPC API endpoint (env: QDRANT_CLOUD_ENDPOINT, default grpc.cloud.qdrant.io:443)
+      --json                 Output as JSON
+```
+
+### SEE ALSO
+
+* [qcloud auth](qcloud_auth.md)	 - Log in to Qdrant Cloud with a browser
+

docs/reference/qcloud_auth_login.md

@@ -0,0 +1,80 @@
+## qcloud auth login
+
+Log in with a browser or device code
+
+### Synopsis
+
+Log in and store a refreshable access token for the current endpoint.
+
+The default flow is authorization code + PKCE with a loopback listener on
+127.0.0.1 (RFC 8252), on the first free port of 48271, 48272 and 48273. The
+browser callback checks state and, when Auth0 sends it, iss.
+
+Use --device on SSH or when no browser is available. The CLI only prints the
+verification URL and polls. Sign-in and the Qdrant consent page happen in the
+browser; a declined consent ends the poll with access denied.
+
+The login URL comes from the gateway's unauthenticated protected-resource
+metadata when OAuth is enabled, otherwise from rewriting grpc.cloud.qdrant.io
+to login.cloud.qdrant.io. Override with --login-url only for debugging.
+
+The Qdrant Cloud CLI client id is built in per login URL. --client-id or
+QDRANT_CLOUD_OAUTH_CLIENT_ID override it, for a tenant without a built-in id.
+The access and refresh tokens are stored in the OS keychain (macOS Keychain,
+Windows Credential Manager, or the Secret Service on Linux); the rest of the
+session is in credentials.yaml next to the config file. Without a keychain, the
+tokens go to credentials.yaml (mode 0600) too. Set QDRANT_CLOUD_TOKEN_STORE to
+"keychain" to require the keychain, or to "file" to skip it.
+
+After the login, qcloud creates a context for every account you granted on the
+consent page (named after the account, prefixed with the environment, e.g.
+dev-my-account), marked as OAuth so it needs no API key. Unless you already have
+a current context, the first one becomes current; switch with
+"qcloud context use <name>". A later login updates
+these contexts, and "qcloud auth logout" removes them. Contexts with an API key
+are never changed.
+
+```
+qcloud auth login [flags]
+```
+
+### Examples
+
+```
+# Browser login (default production endpoint)
+qcloud auth login
+
+# Read-only session
+qcloud auth login --scope read-only
+
+# Device code
+qcloud auth login --device
+```
+
+### Options
+
+```
+      --client-id string   Override the built-in OAuth client id (env: QDRANT_CLOUD_OAUTH_CLIENT_ID)
+      --device             Use the device authorization grant instead of a loopback browser flow
+  -h, --help               help for login
+      --login-url string   Override the login issuer URL (defaults to discovery / endpoint inference)
+      --scope string       OAuth scope: read-only or manage (default "manage")
+```
+
+### Options inherited from parent commands
+
+```
+      --account-id string    Qdrant Cloud Account ID (env: QDRANT_CLOUD_ACCOUNT_ID)
+      --api-key string       Management API Key (env: QDRANT_CLOUD_API_KEY)
+  -c, --config string        Config file path (env: QDRANT_CLOUD_CONFIG, default ~/.config/qcloud/config.yaml)
+      --console-url string   Qdrant Cloud web console base URL (env: QDRANT_CLOUD_CONSOLE_URL, default https://cloud.qdrant.io)
+      --context string       Override the active context (env: QDRANT_CLOUD_CONTEXT)
+      --debug                Enable debug logging to stderr
+      --endpoint string      gRPC API endpoint (env: QDRANT_CLOUD_ENDPOINT, default grpc.cloud.qdrant.io:443)
+      --json                 Output as JSON
+```
+
+### SEE ALSO
+
+* [qcloud auth](qcloud_auth.md)	 - Log in to Qdrant Cloud with a browser
+

docs/reference/qcloud_auth_logout.md

@@ -0,0 +1,45 @@
+## qcloud auth logout
+
+Log out and drop stored OAuth tokens
+
+### Synopsis
+
+Remove the stored OAuth token for the current endpoint.
+
+If the authorization server advertises a revocation endpoint, the refresh
+token is revoked first. Management API keys in the config file are not
+changed.
+
+```
+qcloud auth logout [flags]
+```
+
+### Examples
+
+```
+qcloud auth logout
+```
+
+### Options
+
+```
+  -h, --help   help for logout
+```
+
+### Options inherited from parent commands
+
+```
+      --account-id string    Qdrant Cloud Account ID (env: QDRANT_CLOUD_ACCOUNT_ID)
+      --api-key string       Management API Key (env: QDRANT_CLOUD_API_KEY)
+  -c, --config string        Config file path (env: QDRANT_CLOUD_CONFIG, default ~/.config/qcloud/config.yaml)
+      --console-url string   Qdrant Cloud web console base URL (env: QDRANT_CLOUD_CONSOLE_URL, default https://cloud.qdrant.io)
+      --context string       Override the active context (env: QDRANT_CLOUD_CONTEXT)
+      --debug                Enable debug logging to stderr
+      --endpoint string      gRPC API endpoint (env: QDRANT_CLOUD_ENDPOINT, default grpc.cloud.qdrant.io:443)
+      --json                 Output as JSON
+```
+
+### SEE ALSO
+
+* [qcloud auth](qcloud_auth.md)	 - Log in to Qdrant Cloud with a browser
+

docs/reference/qcloud_auth_status.md

@@ -0,0 +1,44 @@
+## qcloud auth status
+
+Show OAuth login status for the current endpoint
+
+### Synopsis
+
+Show whether an OAuth session exists for the current endpoint.
+
+Prints the inferred login URL, token expiry, and scope. Does not print the
+access token.
+
+```
+qcloud auth status [flags]
+```
+
+### Examples
+
+```
+qcloud auth status
+```
+
+### Options
+
+```
+  -h, --help   help for status
+```
+
+### Options inherited from parent commands
+
+```
+      --account-id string    Qdrant Cloud Account ID (env: QDRANT_CLOUD_ACCOUNT_ID)
+      --api-key string       Management API Key (env: QDRANT_CLOUD_API_KEY)
+  -c, --config string        Config file path (env: QDRANT_CLOUD_CONFIG, default ~/.config/qcloud/config.yaml)
+      --console-url string   Qdrant Cloud web console base URL (env: QDRANT_CLOUD_CONSOLE_URL, default https://cloud.qdrant.io)
+      --context string       Override the active context (env: QDRANT_CLOUD_CONTEXT)
+      --debug                Enable debug logging to stderr
+      --endpoint string      gRPC API endpoint (env: QDRANT_CLOUD_ENDPOINT, default grpc.cloud.qdrant.io:443)
+      --json                 Output as JSON
+```
+
+### SEE ALSO
+
+* [qcloud auth](qcloud_auth.md)	 - Log in to Qdrant Cloud with a browser
+

docs/reference/qcloud_auth_token.md

@@ -0,0 +1,46 @@
+## qcloud auth token
+
+Print a fresh OAuth access token (sensitive)
+
+### Synopsis
+
+Print a fresh OAuth access token for the current endpoint.
+
+The token is sensitive. Use this for local Terraform (auth = "cli") or scripts
+that need a Bearer token. Expired access tokens are refreshed when a refresh
+token is stored.
+
+```
+qcloud auth token [flags]
+```
+
+### Examples
+
+```
+qcloud auth token
+qcloud auth token --json
+```
+
+### Options
+
+```
+  -h, --help   help for token
+```
+
+### Options inherited from parent commands
+
+```
+      --account-id string    Qdrant Cloud Account ID (env: QDRANT_CLOUD_ACCOUNT_ID)
+      --api-key string       Management API Key (env: QDRANT_CLOUD_API_KEY)
+  -c, --config string        Config file path (env: QDRANT_CLOUD_CONFIG, default ~/.config/qcloud/config.yaml)
+      --console-url string   Qdrant Cloud web console base URL (env: QDRANT_CLOUD_CONSOLE_URL, default https://cloud.qdrant.io)
+      --context string       Override the active context (env: QDRANT_CLOUD_CONTEXT)
+      --debug                Enable debug logging to stderr
+      --endpoint string      gRPC API endpoint (env: QDRANT_CLOUD_ENDPOINT, default grpc.cloud.qdrant.io:443)
+      --json                 Output as JSON
+```
+
+### SEE ALSO
+
+* [qcloud auth](qcloud_auth.md)	 - Log in to Qdrant Cloud with a browser
+

docs/reference/qcloud_context_set.md

@@ -6,9 +6,11 @@ Create or update a context
 
 Create or update a named context in the configuration file.
 
-A context stores connection settings (endpoint, account ID) and API key
-credentials under a name, so you can switch between environments with
-"qcloud context use <name>".
+A context stores connection settings (endpoint, account ID) and an API key
+under a name, so you can switch between environments with
+"qcloud context use <name>". Contexts that use your OAuth login instead are
+created by "qcloud auth login", one per account you granted; this command does
+not change those.
 
 There are three ways to provide the API key: