Authentication and profiles

Before the CLI can do anything it needs to know two things: which deployment to talk to, and who you are. This page covers both, the commands that set them (login and logout), and the API-key commands you use to mint a key from the terminal.

The credential is an API key

The CLI signs in with an API key and nothing else. Email and password sign-in is browser-only: the web application's sign-in carries the authenticator, email-verification and consent steps a terminal cannot complete, so the CLI never asks for a password and never accepts a pasted session token.

Credential	Lifetime	How you get it	Use it for
API key	Until you revoke it, or its expiry passes	The web app, under Settings then Developer access, or auth api-key-create from a terminal that is already signed in	Everything: your own terminal, CI jobs, automation, MCP hosts

Every credential is sent to the platform as an HTTP Authorization: Bearer header. An API key is prefixed clika_, is scoped when it is created (it can never do more than its owner may), and is revoked from the same settings page or with auth api-key-delete-id. A key never refreshes, because it does not need to.

login

Saves an API key and a base URL to a profile file, so later commands need neither flag. Run at a terminal with no flag, it prompts for the key without echoing it; scripts pass the key with --api-key or CLIKA_API_KEY instead.

clika-cli login [flags]

Flags

Flag	Type	Default	Meaning
--api-key	string (global)	prompt	The clika_ API key to store. Omitted at a terminal, login prompts for it without echo; omitted without a terminal and with no CLIKA_API_KEY, login stops, writes nothing and says where to create a key. A key given as a bare argument is refused, because it would land in shell history.
--base-url	string (global)	none	The deployment to log in to. Required the first time.
--profile	string (global)	default	Which profile file to write.
--insecure-tls	bool (global)	false	Skip certificate verification, for an on-premise stack with a throwaway certificate authority.

Passing the key without leaking it

At a terminal, run login with no flag and type the key at the prompt; nothing is echoed or recorded. Scripts pass it one of these ways:

clika-cli login --api-key clika_abc123...     # visible in shell history
clika-cli login --api-key=clika_abc123...     # same
CLIKA_API_KEY=clika_abc123... clika-cli login  # from the environment

When standard input is piped, the value is read from it, which is the safe form for CI and Kubernetes:

echo "$CLIKA_API_KEY_FROM_SECRET_STORE" | clika-cli --base-url https://platform.clika.io login --api-key

Examples

Log in at a terminal, prompted:

$ clika-cli --base-url https://platform.clika.io login
API key:
logged in, profile "default"

Log in to an on-premise development stack that uses a self-signed certificate, under its own profile:

clika-cli --base-url https://192.168.10.2 --insecure-tls login --profile onprem

Credential precedence

A command resolves its credential and base URL from the first source that has them:

1. The --api-key and --base-url flags (a bare --api-key with piped standard input reads the key from it).
2. The CLIKA_API_KEY and CLIKA_BASE_URL environment variables.
3. The saved profile named by --profile, defaulting to default.

login itself adds one more step after the environment: at a terminal it prompts; without a terminal it stops and names where to create a key.

This is what makes a CI job easy: set two environment variables and never run login at all.

CLIKA_BASE_URL=https://platform.clika.io CLIKA_API_KEY=clika_... clika-cli devices list

Profiles

A profile is one deployment's address plus one API key, saved in a file. It is what lets a single machine address a cloud deployment and an on-premise deployment without retyping anything.

login writes $XDG_CONFIG_HOME/clika-cli/<profile>.json, which by default is ~/.config/clika-cli/<profile>.json, with mode 0600 so only your account can read it. Every command accepts --profile, and it defaults to default.

clika-cli --base-url https://platform.clika.io login --profile cloud
clika-cli --base-url https://192.168.10.2 --insecure-tls login --profile onprem

clika-cli --profile onprem devices list
clika-cli --profile cloud benchmarks watch nightly-llm-sweep

Because a profile carries the base URL as well as the credential, neither --base-url nor a key is needed again after the first login.

logout

Removes the credential saved in a profile.

clika-cli logout [flags]

It deletes the profile's credential file. The API key it held is not a session and stays valid until you revoke it, in the web app or with auth api-key-delete-id <id>. A profile written by an earlier CLI version's email and password login still holds a session; that one is revoked on the server first, and the local file is cleared even when the server already considers it expired.

clika-cli logout
clika-cli logout --profile onprem

Minting an API key for CI

auth api-key-create mints a key without leaving the terminal. The response contains the key exactly once, so capture it immediately.

The request body must set exactly one of template or scopes.

Body field	Type	Meaning
name	string	The label you will see in the web app's key list.
template	string	A ready-made scope: viewer (reads only), worker (reads plus create, update, cancel and invoke, which is the CI shape), or admin (every delegatable permission you yourself hold, deletes included).
scopes	array of strings	An explicit permission allowlist instead of a template, for example ["artifacts:read","jobs:read","jobs:write"]. Every entry must be a delegatable permission and one you hold yourself.
expires_in_days	integer	How long the key lives. Omit the field for the platform default of 90 days, pass 0 for a key that never expires, or any number of days up to 3650.

A key can never grant more than you have. Requests made with it resolve to the intersection of your own permissions and the key's scope, so narrowing your account later narrows the key with it. Device shell access, tunnels and remote desktop are in no template at all and have to be requested explicitly in scopes.

$ clika-cli auth api-key-create --body '{"name":"nightly-ci","template":"worker","expires_in_days":365}'
{
  "id": "8f2c...",
  "name": "nightly-ci",
  "key": "clika_...",
  "expires_at": "2027-09-03T00:00:00Z"
}

auth api-key-scope-catalog describes every scope a key may carry, which is the list to read before writing a scopes array by hand.

List and revoke keys with the neighbouring commands:

clika-cli auth api-key
clika-cli auth api-key-delete-id 8f2c1d34-5678-90ab-cdef-1234567890ab

Related commands

Command	What it does
auth me	Prints the account the current credential belongs to. The quickest way to answer "who am I logged in as".
auth me-orgs	Lists the organizations your account belongs to.
auth me-projects	Lists the projects you can see.
auth sessions	Lists your active sessions, browser sessions included.
auth sessions-delete-id <id>	Revokes one session by id.
auth switch-org, auth switch-project	Move the current session to another organization or project.
auth cli-download-token	Mints the short-lived token that the CLI install channel accepts. Useful for scripting an install.
auth change-password	Changes your own password; the CLI itself never uses the password.

Full command reference

Every command below is generated from the deployment's own API description, so one subcommand is exactly one platform operation. Each entry names the method, the endpoint and the MCP tool name, so the same operation is identifiable whichever surface you drive it from. Path parameters are positional arguments, query parameters are flags, and a request body is --body or --body-file. The hand-written commands, the ones that stream, propagate an exit code, or hand your terminal to ssh, carry no operation line.

The prose above covers the commands most people reach for. This section is the complete surface, for when you need the flag you have not used before.

clika-cli login

clika-cli login

Saves an API key to a profile file for later use by other commands.

clika-cli login [flags]

clika-cli logout

clika-cli logout

Removes the profile's credentials file. The API key it held is not a session and stays valid until revoked, in the web app, or with clika-cli auth api-key-delete-id <id>.

clika-cli logout [flags]

clika-cli auth

auth has 39 subcommands.

clika-cli auth accept-invite

Accept invitation

clika-cli auth accept-invite [flags]

Flag	Type	Default	Meaning
--body	string	none	request body (inline JSON)
--body-file	string	none	request body (path to a JSON file)
--raw	bool	false	print raw response without pretty-printing

Endpoint: POST /api/auth/accept-invite. MCP tool name: post_auth_accept_invite.

clika-cli auth api-key

List API keys

clika-cli auth api-key [flags]

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing

Endpoint: GET /api/auth/api-key. MCP tool name: get_auth_api_key.

clika-cli auth api-key-create

Create API key

clika-cli auth api-key-create [flags]

Flag	Type	Default	Meaning
--body	string	none	request body (inline JSON)
--body-file	string	none	request body (path to a JSON file)
--raw	bool	false	print raw response without pretty-printing

Endpoint: POST /api/auth/api-key. MCP tool name: post_auth_api_key.

clika-cli auth api-key-delete-id

Revoke API key

clika-cli auth api-key-delete-id <id> [flags]

Positional arguments: required <id>.

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing

Endpoint: DELETE /api/auth/api-key/{id}. MCP tool name: delete_auth_api_key_id.

clika-cli auth api-key-rotate

Rotate API key

clika-cli auth api-key-rotate <id> [flags]

Positional arguments: required <id>.

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing

Endpoint: POST /api/auth/api-key/{id}/rotate. MCP tool name: post_auth_api_key_id_rotate.

clika-cli auth api-key-scope-catalog

Describe the API-key scope catalogue

clika-cli auth api-key-scope-catalog [flags]

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing

Endpoint: GET /api/auth/api-key/scope-catalog. MCP tool name: get_auth_api_key_scope_catalog.

clika-cli auth capabilities

The caller's effective capabilities

clika-cli auth capabilities [flags]

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing

Endpoint: GET /api/auth/capabilities. MCP tool name: get_auth_capabilities.

clika-cli auth captcha

Captcha requirement for the credential forms

clika-cli auth captcha [flags]

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing

Endpoint: GET /api/auth/captcha. MCP tool name: get_auth_captcha.

clika-cli auth change-password

Change password

clika-cli auth change-password [flags]

Flag	Type	Default	Meaning
--body	string	none	request body (inline JSON)
--body-file	string	none	request body (path to a JSON file)
--raw	bool	false	print raw response without pretty-printing

Endpoint: POST /api/auth/change-password. MCP tool name: post_auth_change_password.

clika-cli auth check-email

Check whether an email is already registered

clika-cli auth check-email [flags]

Flag	Type	Default	Meaning
--code	string	none	A signup code; when it admits the address, signup_enabled is true
--email	string	none	Email address to check
--raw	bool	false	print raw response without pretty-printing

Endpoint: GET /api/auth/check-email. MCP tool name: get_auth_check_email.

clika-cli auth cli-download-token

Mint a CLI download token

clika-cli auth cli-download-token [flags]

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing

Endpoint: POST /api/auth/cli-download-token. MCP tool name: post_auth_cli_download_token.

clika-cli auth forgot-password

Request password reset

clika-cli auth forgot-password [flags]

Flag	Type	Default	Meaning
--body	string	none	request body (inline JSON)
--body-file	string	none	request body (path to a JSON file)
--raw	bool	false	print raw response without pretty-printing

Endpoint: POST /api/auth/forgot-password. MCP tool name: post_auth_forgot_password.

clika-cli auth invite-info

Get invitation info

clika-cli auth invite-info [flags]

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing
--token	string	none	Invitation token from the invite email

Endpoint: GET /api/auth/invite-info. MCP tool name: get_auth_invite_info.

clika-cli auth login

Login

clika-cli auth login [flags]

Flag	Type	Default	Meaning
--body	string	none	request body (inline JSON)
--body-file	string	none	request body (path to a JSON file)
--raw	bool	false	print raw response without pretty-printing

Endpoint: POST /api/auth/login. MCP tool name: post_auth_login.

clika-cli auth logout

Logout

clika-cli auth logout [flags]

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing

Endpoint: POST /api/auth/logout. MCP tool name: post_auth_logout.

clika-cli auth me

Get current user

clika-cli auth me [flags]

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing

Endpoint: GET /api/auth/me. MCP tool name: get_auth_me.

clika-cli auth me-orgs

List my organizations

clika-cli auth me-orgs [flags]

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing

Endpoint: GET /api/auth/me/orgs. MCP tool name: get_auth_me_orgs.

clika-cli auth me-projects

List my projects

clika-cli auth me-projects [flags]

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing

Endpoint: GET /api/auth/me/projects. MCP tool name: get_auth_me_projects.

clika-cli auth oauth2-callback

OAuth2/OIDC callback (platform-configured provider)

clika-cli auth oauth2-callback <provider> [flags]

Positional arguments: required <provider>.

Flag	Type	Default	Meaning
--code	string	none	OAuth2 authorization code
--raw	bool	false	print raw response without pretty-printing
--redirect_uri	string	none	Redirect URI to present at code exchange; must equal the one used at init. Defaults to this endpoint's own URL
--state	string	none	OAuth2 state parameter, as returned by the identity provider

Endpoint: GET /api/auth/oauth2/{provider}/callback. MCP tool name: get_auth_oauth2_provider_callback.

clika-cli auth refresh

Refresh access token

clika-cli auth refresh [flags]

Flag	Type	Default	Meaning
--body	string	none	request body (inline JSON)
--body-file	string	none	request body (path to a JSON file)
--raw	bool	false	print raw response without pretty-printing

Endpoint: POST /api/auth/refresh. MCP tool name: post_auth_refresh.

clika-cli auth resend-verification

Resend verification email

clika-cli auth resend-verification [flags]

Flag	Type	Default	Meaning
--body	string	none	request body (inline JSON)
--body-file	string	none	request body (path to a JSON file)
--raw	bool	false	print raw response without pretty-printing

Endpoint: POST /api/auth/resend-verification. MCP tool name: post_auth_resend_verification.

clika-cli auth reset-password

Reset password with token

clika-cli auth reset-password [flags]

Flag	Type	Default	Meaning
--body	string	none	request body (inline JSON)
--body-file	string	none	request body (path to a JSON file)
--raw	bool	false	print raw response without pretty-printing

Endpoint: POST /api/auth/reset-password. MCP tool name: post_auth_reset_password.

clika-cli auth saml-acs

SAML Assertion Consumer Service

clika-cli auth saml-acs <provider> [flags]

Positional arguments: required <provider>.

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing

Endpoint: POST /api/auth/saml/{provider}/acs. MCP tool name: post_auth_saml_provider_acs.

clika-cli auth saml-by-id-acs

SAML Assertion Consumer Service (organization provider)

clika-cli auth saml-by-id-acs <provider_id> [flags]

Positional arguments: required <provider_id>.

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing

Endpoint: POST /api/auth/saml/by-id/{provider_id}/acs. MCP tool name: post_auth_saml_by_id_provider_id_acs.

clika-cli auth saml-by-id-login

Initiate SAML login (organization provider)

clika-cli auth saml-by-id-login <provider_id> [flags]

Positional arguments: required <provider_id>.

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing
--redirect_url	string	none	URL to redirect to after successful login

Endpoint: GET /api/auth/saml/by-id/{provider_id}/login. MCP tool name: get_auth_saml_by_id_provider_id_login.

clika-cli auth saml-by-id-metadata

SAML SP metadata (organization provider)

clika-cli auth saml-by-id-metadata <provider_id> [flags]

Positional arguments: required <provider_id>.

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing

Endpoint: GET /api/auth/saml/by-id/{provider_id}/metadata. MCP tool name: get_auth_saml_by_id_provider_id_metadata.

clika-cli auth saml-login

Initiate SAML login

clika-cli auth saml-login <provider> [flags]

Positional arguments: required <provider>.

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing
--redirect_url	string	none	URL to redirect to after successful login

Endpoint: GET /api/auth/saml/{provider}/login. MCP tool name: get_auth_saml_provider_login.

clika-cli auth saml-metadata

SAML SP metadata

clika-cli auth saml-metadata <provider> [flags]

Positional arguments: required <provider>.

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing

Endpoint: GET /api/auth/saml/{provider}/metadata. MCP tool name: get_auth_saml_provider_metadata.

clika-cli auth sessions

List active sessions

clika-cli auth sessions [flags]

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing

Endpoint: GET /api/auth/sessions. MCP tool name: get_auth_sessions.

clika-cli auth sessions-delete-id

Revoke session

clika-cli auth sessions-delete-id <id> [flags]

Positional arguments: required <id>.

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing

Endpoint: DELETE /api/auth/sessions/{id}. MCP tool name: delete_auth_sessions_id.

clika-cli auth signup

Sign up a new user

clika-cli auth signup [flags]

Flag	Type	Default	Meaning
--body	string	none	request body (inline JSON)
--body-file	string	none	request body (path to a JSON file)
--raw	bool	false	print raw response without pretty-printing

Endpoint: POST /api/auth/signup. MCP tool name: post_auth_signup.

clika-cli auth signup-codes-preview

Preview a signup code

clika-cli auth signup-codes-preview [flags]

Flag	Type	Default	Meaning
--code	string	none	The signup code, with or without its dashes
--raw	bool	false	print raw response without pretty-printing

Endpoint: GET /api/auth/signup-codes/preview. MCP tool name: get_auth_signup_codes_preview.

clika-cli auth sso-authorize

Initiate SSO login (OAuth2/OIDC)

clika-cli auth sso-authorize <provider> [flags]

Positional arguments: required <provider>.

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing
--redirect_url	string	none	URL to redirect to after successful login

Endpoint: GET /api/auth/sso/{provider}/authorize. MCP tool name: get_auth_sso_provider_authorize.

clika-cli auth sso-callback

OAuth2/OIDC callback

clika-cli auth sso-callback <provider> [flags]

Positional arguments: required <provider>.

Flag	Type	Default	Meaning
--code	string	none	OAuth2 authorization code
--raw	bool	false	print raw response without pretty-printing
--state	string	none	OAuth2 state parameter

Endpoint: GET /api/auth/sso/{provider}/callback. MCP tool name: get_auth_sso_provider_callback.

clika-cli auth sso-check-email

Check email domain for SSO

clika-cli auth sso-check-email [flags]

Flag	Type	Default	Meaning
--email	string	none	Email address to check
--raw	bool	false	print raw response without pretty-printing

Endpoint: GET /api/auth/sso/check-email. MCP tool name: get_auth_sso_check_email.

clika-cli auth sso-providers

List public SSO providers

clika-cli auth sso-providers [flags]

Flag	Type	Default	Meaning
--raw	bool	false	print raw response without pretty-printing

Endpoint: GET /api/auth/sso/providers. MCP tool name: get_auth_sso_providers.

clika-cli auth switch-org

Switch organization

clika-cli auth switch-org [flags]

Flag	Type	Default	Meaning
--body	string	none	request body (inline JSON)
--body-file	string	none	request body (path to a JSON file)
--raw	bool	false	print raw response without pretty-printing

Endpoint: POST /api/auth/switch-org. MCP tool name: post_auth_switch_org.

clika-cli auth switch-project

Switch project

clika-cli auth switch-project [flags]

Flag	Type	Default	Meaning
--body	string	none	request body (inline JSON)
--body-file	string	none	request body (path to a JSON file)
--raw	bool	false	print raw response without pretty-printing

Endpoint: POST /api/auth/switch-project. MCP tool name: post_auth_switch_project.

clika-cli auth verify-email

Verify email

clika-cli auth verify-email [flags]

Flag	Type	Default	Meaning
--body	string	none	request body (inline JSON)
--body-file	string	none	request body (path to a JSON file)
--raw	bool	false	print raw response without pretty-printing

Endpoint: POST /api/auth/verify-email. MCP tool name: post_auth_verify_email.

Related

• CLI overview: install, global flags, output formats and exit codes.
• self-update: keeping the binary in step with the deployment.
• MCP server: the same credentials, used by an AI assistant.