https://<cluster-id>.k8s.raffusercloud.com:6443, and access is by kubeconfig. Every credential we issue expires — there is no permanent kubeconfig, so a leaked file always has an end date and can be revoked immediately.
There are two ways to get one. They differ only in whether you ever have to think about renewal.
The CLI kubeconfig renews itself
The file the CLI writes contains no credential at all — no token, no client key. It carries the API server address, the cluster CA, and an instruction to run the Raff CLI:kubectl runs that command and receives a short-lived token (one hour by default, --ttl to change). Nothing long-lived is written to disk, the file is useless to anyone without your API key, and you never re-download it. It uses the standard Kubernetes client-go exec credential interface, so it works with kubectl, Helm and any other client that speaks it.
Use this for workstations, CI, and anything long-running.
The CLI must be installed and authenticated wherever
kubectl runs — including CI images. If it cannot be, use a downloaded kubeconfig (--static in the CLI) and plan for its expiry.Downloaded kubeconfigs expire
A downloaded kubeconfig carries a token inside it, so it works anywhere without the CLI — and stops working when the token expires. Choose the lifetime under Settings → Access: 1 hour, 8 hours, 24 hours, 7 days, or 30 days. The choice is remembered per cluster and reused by the kubeconfig button in the header, so you set it once. Thirty days is the maximum. Longer-lived files are not offered on purpose: a kubeconfig grants full cluster-admin access while it is valid, and a credential that outlives everyone’s memory of creating it is the problem short-lived credentials exist to solve. If you don’t want to think about expiry, use the CLI — it removes the deadline rather than postponing it. Over the API,expires_in selects the lifetime in seconds (600–2592000):
Revoking access
Settings → Access → Revoke (orraff kubernetes kubeconfig rotate <cluster-id>) invalidates every kubeconfig and token issued for the cluster, immediately — downloaded files and CLI sessions alike. Use it when a credential leaks or someone leaves the team.
Revoking does not interrupt running workloads; it only ends existing API access. Downloading again, or running any kubectl command through a CLI kubeconfig, issues a fresh credential.