You work with Origin Cloud through the console, the origin CLI or the GraphQL API. All three talk to the same API and act as you, so they see the same organizations and are bound by the same roles. A change you make in one shows up in the others.
The following diagram shows how a person and an automated job reach the GraphQL API, and with which credential.
Key concepts
Login page
Where people authenticate, with whatever sign-in methods your account has, including a second factor. Neither the console nor the CLI sees your password. See Use the CLI.
Access token
A short-lived bearer token that every API request carries in its Authorization header. The CLI gets and renews one for you. See Use the GraphQL API.
Service account
A credential for automation, such as CI jobs and scripts, that authenticates as itself rather than as a person. See Service accounts.
Resource URN
The identifier the API and the CLI use for every resource. See Use the GraphQL API.
Compare the access methods
| Method | Best for | Authenticates as |
|---|---|---|
| Console | Working in a browser | A person |
origin CLI | Interactive work in a terminal and simple scripts | A person |
| GraphQL API | Automation, integrations, and anything the CLI doesn’t cover | A person or a service account |
The CLI covers organizations, projects, compute, storage, network and IAM. Some operations exist only in the API, among them billing accounts and payment methods, quotas, metrics and the audit log.