​

auth

orc auth configures CLI authentication by authorizing your account in the browser or saving an API key from standard input. It verifies the active credential with the server and logs out of stored CLI sessions.

orc login and orc logout are shortcuts for orc auth login and orc auth logout. Browser authorization for a human account and Workspace API keys are different authentication methods. Passing a secret directly through --api-key is deprecated. Use orc whoami for account details and orc status to diagnose configuration and connectivity.

Authorize the CLI in the browser.

In an interactive terminal, opens Orchestor authorization. Check that the confirmation code matches your terminal, then authorize the CLI. If signed out, complete normal sign-in or registration and return to authorization. Existing web sign-in is reused. API keys can be read and saved from standard input. Saving alone does not necessarily verify an API key; check it with auth status. --web explicitly selects browser authorization.

API key (deprecated; pipe via standard input instead)

Type: string. Optional.

Named credential profile to activate

Type: string. Optional.

Credential scope: org:admin

Type: string. Optional.

Browser authorization (explicit alias)

Type: boolean. Optional.

Verifies the current credential through /v1/auth/validate and returns authenticated, valid, its source and kind, a non-secret opaque_id, workspace_id, and detail. A valid credential returns exit code 0; other results return1. auth status get and auth validate are compatibility aliases.

If a stored CLI session refresh token exists, requests revocation before removing the stored API key, access token, refresh token, and expiry. Retry if revocation fails. ORCHESTOR_API_KEY still takes precedence when it remains in the environment; remove that setting to log out completely.

Writes the resolved secret credential to standard output with a newline. This is an explicit secret export, unlike normal diagnostics. Do not run it in shared terminals, logs, or recordings. Returns exit code 2 when no credential is available.

Use existing secure environment configuration instead of entering the secret directly into shell history. Verify it afterwards with orc auth status.

Save an API key from standard input.

Verify authentication as JSON.

Authorize a named organization administrator profile.

Browser authorization creates a CLI session independent of the web session. Authorization requests expire after 10 minutes. Run orc auth login again if interrupted.

Browser authorization saves and reloads credentials and returns Workspace readiness and next steps. When beta participation or initial setup is required, the saved credentials remain available for those operations.

--profile <name> separates credential configurations. --scope org:admin requires a named profile and cannot be combined with --workspace.

The following global options can be used with orc auth:

For details and examples, see global options.