diff --git a/api/python/quilt3/main.py b/api/python/quilt3/main.py
index b8061826dde..c430d06b1b6 100644
--- a/api/python/quilt3/main.py
+++ b/api/python/quilt3/main.py
@@ -224,6 +224,20 @@ def cmd_push(name, dir, registry, dest, message, meta, workflow, force, dedupe,
     )
 
 
+def cmd_get_credentials():
+    # TODO: check that the user is logged in
+    # TODO: do not refresh credentials if they are still valid?
+    session._refresh_credentials()
+    creds = session._load_credentials()
+    print(json.dumps({
+        "Version": 1,
+        "AccessKeyId": creds["access_key"],
+        "SecretAccessKey": creds["secret_key"],
+        "SessionToken": creds["token"],
+        "Expiration": creds["expiry_time"],
+    }))
+
+
 def create_parser():
     parser = argparse.ArgumentParser(allow_abbrev=False)
     parser.add_argument(
@@ -481,6 +495,11 @@ def create_parser():
     )
     push_p.set_defaults(func=cmd_push)
 
+    # get-credentials
+    shorthelp = "Get temporary AWS credentials for the current user"  # TODO
+    get_credentials_p = subparsers.add_parser("get-credentials", description=shorthelp, help=shorthelp, allow_abbrev=False)
+    get_credentials_p.set_defaults(func=cmd_get_credentials)
+
     return parser