To start using the Tanzu Service Mesh CLI, you must log in to the SaaS endpoint on which you want to perform actions.


  • Download and Install the CLI.

  • The Tanzu Service Mesh CLI interacts with Tanzu Service Mesh SaaS. Make sure that you know the URL of the Tanzu Service Mesh SaaS server.

  • In VMware Cloud Services, generate an API token to authenticate with the Tanzu Service Mesh SaaS server. To generate an API token:

    1. Access the Tanzu Service Mesh Console.

    2. In the upper-right corner, click your user name and under User Settings, click My Account.

    3. On the My Account page, click the API Tokens tab and click Generate Token.

    4. Provide the following information:

      Token parameter


      Token Name

      Enter a meaningful name for the token.

      Token TTL

      Specify how long the token is valid. You can set the token to never expire, but this is a security risk.

      Define Scopes

      Define the scopes for the token.

      Under Organization Roles, select the organization roles that the token can access. Under Service Roles, select VMware Tanzu Service Mesh and select the user roles within Tanzu Service Mesh that the token can access.


      Select this check box.

    5. Click Generate. A Token Generated dialog box displays the generated token and specifies when the token expires. You can copy, download, and print the token.

    6. To copy the token so you can retrieve it to use later on, click Copy and then paste the token into a file in a safe location.

    7. Click Continue.


  • On the machine where the Tanzu Service Mesh is installed, open a terminal window and run the following CLI command.
    tsm login -s {SaaS server host} -t {API token}

    Where {SaaS server host} is the host name in the URL of the Tanzu Service Mesh SaaS server, and {API token} is the generated API token.

    For example, if the URL of the Tanzu Service Mesh SaaS server is, provide the host name in the command.


You can now run other CLI commands. To get a list of the available commands, run tsm -h.