java -jar jenkins-cli.jar [-s JENKINS_URL] -auth @/home/kohsuke/.jenkins-cli command ... java -jar jenkins-cli.jar [-s JENKINS_URL] -ssh -user kohsuke command ... Generally no special system configuration need be done to enable HTTP-based CLI connections. If you are running Jenkins behind an HTTP(S) reverse proxy, ensure it does not buffer request or response bodies. The HTTP(S) connection mode of the CLI in Jenkins 2.54 and newer does not work correctly behind an Apache HTTP reverse proxy server using mod_proxy. Workarounds include using a different reverse proxy such as Nginx or HAProxy, or using the SSH connection mode where possible. See JENKINS- 47279. Authentication is via SSH keypair. You must select the Jenkins user ID as well: In this mode, the client acts essentially like a native  ssh  command. By default the client will try to connect to an SSH port on the same host as is used in the JENKINS_URL . If Jenkins is behind an HTTP reverse proxy, this will not generally work, so run Jenkins with the system property  -Dorg.jenkinsci.main.modules.sshd.SSHD.hostName=ACTUALHOST  to define a hostname or IP address for the SSH endpoint. This was the only mode supported by clients downloaded from a pre-2.54 / pre-2.46.2 Jenkins server (prior to the introduction of the  -remoting  option). Its use is deprecated for security and performance reasons. That said, certain commands or command modes can  only  run in Remoting mode, typically because the command functionality involves running server-supplied code on the client machine. This mode is disabled on the server side for new installations of 2.54+ and 2.46.2. If you must use it, and accept the risks, it may be enabled in Configure Global Security. Authentication is preferably via SSH keypair. A  login  command and  --username  /  --password command (note:  not global ) options are also available; these are discouraged since they cannot work with a non-password-based security realm, certain command arguments will not be properly parsed if anonymous users lack overall or job read access, and saving human-chosen passwords for use in scripts is considered insecure. Note that there are two transports available for this mode: over HTTP, or over a dedicated TCP socket. If the TCP port is enabled and seems to work, the client will use this transport. If the TCP port is disabled, or such a port is advertised but does not accept connections (for example because you are using an HTTP reverse proxy with a firewall), the client will automatically fall back to the 173 Remoting connection mode SSH connection mode WARNING