Skip to main content
The CLI logs in through your browser and stores one credential per workspace. Nothing asks you to paste an API key.

​
How login works

cloudthinker login opens a consent page in your browser and waits for the approval to come back on a loopback callback. The CLI always prints the URL first, so a terminal without a usable browser still has a path forward.
cloudthinker login printing the consent URL before opening the browser
When your account can reach several workspaces, the consent page asks which one to authorize. The terminal then confirms the workspace it stored.

​
Log in

1

Start the login

2

Approve in the browser

Sign in if you are not already, choose the workspace, and approve the request. The consent code is valid for five minutes.Success state: the terminal prints Logged in to <workspace>.
3

Verify the credential

The answer comes from the API, not from the local file, so it proves the credential actually works.

​
On a machine without a browser

Two flags cover a remote shell:
The CLI also falls back to the device code by itself when it cannot open a loopback port.

​
Work with several workspaces

Each workspace keeps its own credential for the same host, so you log in once per workspace and switch with --workspace. It takes a workspace ID or the exact workspace name.
CLOUDTHINKER_WORKSPACE does the same thing for a whole shell session.

​
Authenticate a script or CI job

A pipeline has no browser. Two paths work:
The value that auth token prints authenticates as you until it expires. Treat it like a password: never log it, never commit it, never paste it into a chat.
CLOUDTHINKER_TOKEN and --workspace cannot be combined. The token already names its workspace, so passing both is rejected as a usage error.

​
Where credentials live

Credentials are written to cloudthinker/credentials.json in your operating system’s config directory, with owner-only permissions. One file holds every workspace credential for a host, keyed by origin and workspace, so logging in to a second workspace never evicts the first.

​
Log out

​
Troubleshooting

The credential is missing or expired. Run cloudthinker login again. In a non-interactive shell the CLI never opens a browser; it prints the command to run and stops.
The environment token outranks stored credentials, so logging in again would change nothing. Replace the token, or unset the variable and run cloudthinker login.
--workspace matches an exact name or a workspace ID. Run cloudthinker whoami to see the name the API uses, and quote a name that contains spaces.

CLI overview

Install the CLI and run your first session

Reference

Every flag, environment variable, and exit code