​
Sign in

​
With an API key

If --api-key is omitted, the CLI prompts interactively. The key is stored according to auth.credential_store in config.toml.

​
With a third-party provider

​
Check status

Output is one of:
  • Authenticated via OAuth token
  • Authenticated via API key: <profile>
  • Not authenticated

​
Authentication profiles

Each profile stores a provider, optional API key, api_key_env reference, and base_url. The first profile created becomes the active profile automatically.

​
Credential store

The auth.credential_store setting controls where secrets are persisted:
Never commit config.toml to version control when it contains API keys. Add it to .gitignore.

​
Headless / CI authentication

For headless environments, pass the API key via environment variable — no interactive login is required:
See CI Mode for full CI pipeline guidance.