Connect a Temporal worker and client to Temporal Cloud using API key or mTLS certificate authentication

Documented steps

1. Identify the namespace and endpoint. Temporal Cloud namespaces are addressed as `<namespace>.<account_id>`, and the gRPC endpoint is `<namespace>.<account_id>.tmprl.cloud:7233`.
2. API key auth in Python: `client = await Client.connect("<namespace>.<account>.tmprl.cloud:7233", namespace="<namespace>.<account_id>", api_key="<your-api-key>", tls=True)`.
3. API key auth in TypeScript: `const connection = await Connection.connect({ address: 'your-namespace.a1b2c.tmprl.cloud:7233', apiKey: 'your-api-key' }); const client = new Client({ connection, namespace: 'your-namespace' });`. For a Worker use `NativeConnection.connect({ address, apiKey })` and pass that connection to `Worker.create({ connection, namespace, taskQueue })`.
4. Generate mTLS certificates: `tcld gen ca --org temporal -d 1y --ca-cert ca.pem --ca-key ca.key`, then `tcld gen leaf --org temporal -d 364d --ca-cert ca.pem --ca-key ca.key --cert client.pem --key client.key` (the `step` CLI works too). CA certs must be X.509v3 with `CA:true`, RSA or ECDSA with SHA-256, and no passphrase; end-entity certs need `CA:false` plus the `clientAuth` extended key usage.
5. Register the CA with Temporal Cloud: upload the CA PEM in the Cloud UI (Namespaces > namespace > Edit > Authentication) or run `tcld namespace accepted-client-ca set --ca-certificate-file <path>`.
6. mTLS auth in Python: read `client-cert.pem` and `client-private-key.pem` as bytes, then `Client.connect(address, namespace=..., tls=TLSConfig(client_cert=client_cert, client_private_key=client_private_key))`.
7. mTLS auth in TypeScript: `Connection.connect({ address, tls: { clientCertPath: '/etc/temporal/certs/client.pem', clientKeyPath: '/etc/temporal/certs/client.key' } })` — the same shape applies to the `NativeConnection.connect` used by Workers.
8. mTLS from the CLI: `temporal <command> --address <ns>.<account>.tmprl.cloud:7233 --tls-cert-path <path> --tls-key-path <path> --tls-ca-path <path> --tls-server-name <name>`.
9. API key auth from the CLI: `export TEMPORAL_API_KEY=<key-secret>` then `temporal workflow list --address <namespace>.<account_id>.tmprl.cloud:7233 --namespace <namespace>.<account_id>`, or pass `--api-key` directly.
10. Prefer loading connection settings from a TOML profile over hardcoding: Python `ClientConfig.load_client_connect_config(profile="staging")` fed into `Client.connect(**connect_config)`, backed by a `[profile.staging]` block containing `address`, `namespace`, and `api_key`.
11. Create and rotate API keys in the Cloud UI (Profile > API Keys) or with `tcld apikey create --name <name> --description "<desc>" --duration <duration>` (e.g. `30d`). The secret is displayed once. Rotate by creating a new key, verifying it, switching Workers over, then deleting the old key.
12. Reference docs: https://docs.temporal.io/cloud/api-keys | https://docs.temporal.io/cloud/certificates | https://docs.temporal.io/cloud/namespaces | https://docs.temporal.io/develop/python/client/temporal-client