--- title: auth description: Configure and verify CLI authentication, and remove stored credentials. canonical_url: https://orchestor.io/docs/en/cli/auth markdown_url: https://orchestor.io/docs/en/cli/auth.md contentType: reference --- # auth `orc auth` configures CLI authentication by authorizing your account in the browser or saving an API key from standard input. It verifies the active credential with the server and logs out of stored CLI sessions. `orc login` and `orc logout` are shortcuts for `orc auth login` and `orc auth logout`. Browser authorization for a human account and Workspace API keys are different authentication methods. Passing a secret directly through `--api-key` is deprecated. Use [`orc whoami`](https://orchestor.io/docs/cli/whoami.md) for account details and [`orc status`](https://orchestor.io/docs/cli/status.md) to diagnose configuration and connectivity. ## Usage ```bash title="terminal" orc auth login ``` *Authorize the CLI in the browser.* ## Subcommands ### `login` In an interactive terminal, opens Orchestor authorization. Check that the confirmation code matches your terminal, then authorize the CLI. If signed out, complete normal sign-in or registration and return to authorization. Existing web sign-in is reused. API keys can be read and saved from standard input. Saving alone does not necessarily verify an API key; check it with `auth status`. `--web` explicitly selects browser authorization. ```bash title="terminal" orc auth login [options] ``` #### Unique options ##### `--api-key` API key (deprecated; pipe via standard input instead) Type: `string`. Optional. ```bash title="terminal" orc auth login --api-key ``` ##### `--profile` Named credential profile to activate Type: `string`. Optional. ```bash title="terminal" orc auth login --profile ``` ##### `--scope` Credential scope: org:admin Type: `string`. Optional. ```bash title="terminal" orc auth login --scope ``` ##### `--web` Browser authorization (explicit alias) Type: `boolean`. Optional. ```bash title="terminal" orc auth login --web ``` ### `status` Verifies the current credential through `/v1/auth/validate` and returns `authenticated`, `valid`, its `source` and `kind`, a non-secret `opaque_id`, `workspace_id`, and `detail`. A valid credential returns exit code 0; other results return1. `auth status get` and `auth validate` are compatibility aliases. ```bash title="terminal" orc auth status [options] ``` ### `logout` If a stored CLI session refresh token exists, requests revocation before removing the stored API key, access token, refresh token, and expiry. Retry if revocation fails. `ORCHESTOR_API_KEY` still takes precedence when it remains in the environment; remove that setting to log out completely. ```bash title="terminal" orc auth logout [options] ``` ### `credential` Writes the resolved secret credential to standard output with a newline. This is an explicit secret export, unlike normal diagnostics. Do not run it in shared terminals, logs, or recordings. Returns exit code 2 when no credential is available. ```bash title="terminal" orc auth credential [options] ``` ## Examples ### Save an API key from standard input. Use existing secure environment configuration instead of entering the secret directly into shell history. Verify it afterwards with `orc auth status`. ```bash title="terminal" printf '%s' "$ORCHESTOR_API_KEY" | orc auth login --workspace ``` *Save an API key from standard input.* ### Verify authentication as JSON. ```bash title="terminal" orc auth status --json ``` *Verify authentication as JSON.* ### Authorize a named organization administrator profile. ```bash title="terminal" orc auth login --web --profile organization-admin --scope org:admin ``` *Authorize a named organization administrator profile.* ## Browser authorization and profiles Browser authorization creates a CLI session independent of the web session. Authorization requests expire after 10 minutes. Run `orc auth login` again if interrupted. Browser authorization saves and reloads credentials and returns Workspace readiness and next steps. When beta participation or initial setup is required, the saved credentials remain available for those operations. `--profile ` separates credential configurations. `--scope org:admin` requires a named profile and cannot be combined with `--workspace`. ## Global Options The following [global options](https://orchestor.io/docs/cli/global-flags.md) can be used with `orc auth`: - [`--help`](https://orchestor.io/docs/cli/global-flags.md#help) - [`--workspace`](https://orchestor.io/docs/cli/global-flags.md#workspace) - [`--json`](https://orchestor.io/docs/cli/global-flags.md#json-output) - [`--pretty`](https://orchestor.io/docs/cli/global-flags.md#json-output) - [`--format`](https://orchestor.io/docs/cli/global-flags.md#output-format) - [`--field`](https://orchestor.io/docs/cli/global-flags.md#field-selection) - [`--fields`](https://orchestor.io/docs/cli/global-flags.md#field-selection) - [`--raw`](https://orchestor.io/docs/cli/global-flags.md#raw-output) - [`--output`](https://orchestor.io/docs/cli/global-flags.md#file-output) - [`--no-pager`](https://orchestor.io/docs/cli/global-flags.md#pager) - [`--dry-run`](https://orchestor.io/docs/cli/global-flags.md#dry-run) - [`--yes`](https://orchestor.io/docs/cli/global-flags.md#confirmation) - [`--stdin`](https://orchestor.io/docs/cli/global-flags.md#standard-input) - [`--from-stdin`](https://orchestor.io/docs/cli/global-flags.md#standard-input) - [`--page-all`](https://orchestor.io/docs/cli/global-flags.md#all-pages) - [`--timing`](https://orchestor.io/docs/cli/global-flags.md#request-timing) - [`--readonly`](https://orchestor.io/docs/cli/global-flags.md#read-only-mode) - [`--wrap-untrusted`](https://orchestor.io/docs/cli/global-flags.md#untrusted-content-wrapping) For details and examples, see [global options](https://orchestor.io/docs/cli/global-flags.md). ## Related - [`orc signup`](https://orchestor.io/docs/cli/signup.md): Account registration and CLI authorization. - [`orc config`](https://orchestor.io/docs/cli/config.md): Local configuration. - [`orc status`](https://orchestor.io/docs/cli/status.md): Connection, credential, and installation diagnostics. --- [Documentation index](https://orchestor.io/docs/llms.txt)