---
title: Authentication and profiles
sidebar_label: login, logout, profiles
description: "clika-cli login, logout and profiles: the API key the CLI signs in with, where it is stored, and how to address several deployments from one machine."
---

Before the CLI can do anything it needs to know two things: which deployment to talk to, and who you are. This page covers both, the commands that set them (`login` and `logout`), and the API-key commands you use to mint a key from the terminal.

## The credential is an API key

The CLI signs in with an API key and nothing else. Email and password sign-in is browser-only: the web application's sign-in carries the authenticator, email-verification and consent steps a terminal cannot complete, so the CLI never asks for a password and never accepts a pasted session token.

| Credential | Lifetime | How you get it | Use it for |
| --- | --- | --- | --- |
| **API key** | Until you revoke it, or its expiry passes | The web app, under **Settings** then **Developer access**, or `auth api-key-create` from a terminal that is already signed in | Everything: your own terminal, CI jobs, automation, MCP hosts |

Every credential is sent to the platform as an HTTP `Authorization: Bearer` header. An API key is prefixed `clika_`, is scoped when it is created (it can never do more than its owner may), and is revoked from the same settings page or with `auth api-key-delete-id`. A key never refreshes, because it does not need to.

## `login`

Saves an API key and a base URL to a profile file, so later commands need neither flag. Run at a terminal with no flag, it prompts for the key without echoing it; scripts pass the key with `--api-key` or `CLIKA_API_KEY` instead.

```
clika-cli login [flags]
```

### Flags

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--api-key` | string (global) | prompt | The `clika_` API key to store. Omitted at a terminal, `login` prompts for it without echo; omitted without a terminal and with no `CLIKA_API_KEY`, `login` stops, writes nothing and says where to create a key. A key given as a bare argument is refused, because it would land in shell history. |
| `--base-url` | string (global) | none | The deployment to log in to. Required the first time. |
| `--profile` | string (global) | `default` | Which profile file to write. |
| `--insecure-tls` | bool (global) | `false` | Skip certificate verification, for an on-premise stack with a throwaway certificate authority. |

### Passing the key without leaking it

At a terminal, run `login` with no flag and type the key at the prompt; nothing is echoed or recorded. Scripts pass it one of these ways:

```
clika-cli login --api-key clika_abc123...     # visible in shell history
clika-cli login --api-key=clika_abc123...     # same
CLIKA_API_KEY=clika_abc123... clika-cli login  # from the environment
```

When standard input is piped, the value is read from it, which is the safe form for CI and Kubernetes:

```
echo "$CLIKA_API_KEY_FROM_SECRET_STORE" | clika-cli --base-url https://platform.clika.io login --api-key
```

### Examples

Log in at a terminal, prompted:

```
$ clika-cli --base-url https://platform.clika.io login
API key:
logged in, profile "default"
```

Log in to an on-premise development stack that uses a self-signed certificate, under its own profile:

```
clika-cli --base-url https://192.168.10.2 --insecure-tls login --profile onprem
```

## Credential precedence

A command resolves its credential and base URL from the first source that has them:

1. The `--api-key` and `--base-url` flags (a bare `--api-key` with piped standard input reads the key from it).
2. The `CLIKA_API_KEY` and `CLIKA_BASE_URL` environment variables.
3. The saved profile named by `--profile`, defaulting to `default`.

`login` itself adds one more step after the environment: at a terminal it prompts; without a terminal it stops and names where to create a key.

This is what makes a CI job easy: set two environment variables and never run `login` at all.

```
CLIKA_BASE_URL=https://platform.clika.io CLIKA_API_KEY=clika_... clika-cli devices list
```

## Profiles

A profile is one deployment's address plus one API key, saved in a file. It is what lets a single machine address a cloud deployment and an on-premise deployment without retyping anything.

`login` writes `$XDG_CONFIG_HOME/clika-cli/<profile>.json`, which by default is `~/.config/clika-cli/<profile>.json`, with mode `0600` so only your account can read it. Every command accepts `--profile`, and it defaults to `default`.

```
clika-cli --base-url https://platform.clika.io login --profile cloud
clika-cli --base-url https://192.168.10.2 --insecure-tls login --profile onprem

clika-cli --profile onprem devices list
clika-cli --profile cloud benchmarks watch nightly-llm-sweep
```

Because a profile carries the base URL as well as the credential, neither `--base-url` nor a key is needed again after the first login.

## `logout`

Removes the credential saved in a profile.

```
clika-cli logout [flags]
```

It deletes the profile's credential file. The API key it held is not a session and stays valid until you revoke it, in the web app or with `auth api-key-delete-id <id>`. A profile written by an earlier CLI version's email and password login still holds a session; that one is revoked on the server first, and the local file is cleared even when the server already considers it expired.

```
clika-cli logout
clika-cli logout --profile onprem
```

## Minting an API key for CI

`auth api-key-create` mints a key without leaving the terminal. The response contains the key exactly once, so capture it immediately.

The request body must set exactly one of `template` or `scopes`.

| Body field | Type | Meaning |
| --- | --- | --- |
| `name` | string | The label you will see in the web app's key list. |
| `template` | string | A ready-made scope: `viewer` (reads only), `worker` (reads plus create, update, cancel and invoke, which is the CI shape), or `admin` (every delegatable permission you yourself hold, deletes included). |
| `scopes` | array of strings | An explicit permission allowlist instead of a template, for example `["artifacts:read","jobs:read","jobs:write"]`. Every entry must be a delegatable permission and one you hold yourself. |
| `expires_in_days` | integer | How long the key lives. Omit the field for the platform default of 90 days, pass `0` for a key that never expires, or any number of days up to 3650. |

A key can never grant more than you have. Requests made with it resolve to the intersection of your own permissions and the key's scope, so narrowing your account later narrows the key with it. Device shell access, tunnels and remote desktop are in no template at all and have to be requested explicitly in `scopes`.

```
$ clika-cli auth api-key-create --body '{"name":"nightly-ci","template":"worker","expires_in_days":365}'
{
  "id": "8f2c...",
  "name": "nightly-ci",
  "key": "clika_...",
  "expires_at": "2027-09-03T00:00:00Z"
}
```

`auth api-key-scope-catalog` describes every scope a key may carry, which is the list to read before writing a `scopes` array by hand.

List and revoke keys with the neighbouring commands:

```
clika-cli auth api-key
clika-cli auth api-key-delete-id 8f2c1d34-5678-90ab-cdef-1234567890ab
```

## Related commands

| Command | What it does |
| --- | --- |
| `auth me` | Prints the account the current credential belongs to. The quickest way to answer "who am I logged in as". |
| `auth me-orgs` | Lists the organizations your account belongs to. |
| `auth me-projects` | Lists the projects you can see. |
| `auth sessions` | Lists your active sessions, browser sessions included. |
| `auth sessions-delete-id <id>` | Revokes one session by id. |
| `auth switch-org`, `auth switch-project` | Move the current session to another organization or project. |
| `auth cli-download-token` | Mints the short-lived token that the CLI install channel accepts. Useful for scripting an install. |
| `auth change-password` | Changes your own password; the CLI itself never uses the password. |

<!-- BEGIN GENERATED COMMAND REFERENCE (NOTES/gen-cli-reference.py) -->

## Full command reference

Every command below is generated from the deployment's own API description, so
one subcommand is exactly one platform operation. Each entry names the method,
the endpoint and the [MCP](mcp.md) tool name, so the same operation is
identifiable whichever surface you drive it from. Path parameters are positional
arguments, query parameters are flags, and a request body is `--body` or
`--body-file`. The hand-written commands, the ones that stream, propagate an
exit code, or hand your terminal to `ssh`, carry no operation line.

The prose above covers the commands most people reach for. This section is the
complete surface, for when you need the flag you have not used before.

### `clika-cli login`

#### `clika-cli login`

Saves an API key to a profile file for later use by other commands.

```
clika-cli login [flags]
```

### `clika-cli logout`

#### `clika-cli logout`

Removes the profile's credentials file. The API key it held is not a session and stays valid until revoked, in the web app, or with `clika-cli auth api-key-delete-id <id>`.

```
clika-cli logout [flags]
```

### `clika-cli auth`

`auth` has 39 subcommands.

#### `clika-cli auth accept-invite`

Accept invitation

```
clika-cli auth accept-invite [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--body` | string | none | request body (inline JSON) |
| `--body-file` | string | none | request body (path to a JSON file) |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `POST /api/auth/accept-invite`. MCP tool name: `post_auth_accept_invite`.

#### `clika-cli auth api-key`

List API keys

```
clika-cli auth api-key [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `GET /api/auth/api-key`. MCP tool name: `get_auth_api_key`.

#### `clika-cli auth api-key-create`

Create API key

```
clika-cli auth api-key-create [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--body` | string | none | request body (inline JSON) |
| `--body-file` | string | none | request body (path to a JSON file) |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `POST /api/auth/api-key`. MCP tool name: `post_auth_api_key`.

#### `clika-cli auth api-key-delete-id`

Revoke API key

```
clika-cli auth api-key-delete-id <id> [flags]
```

Positional arguments: required `<id>`.

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `DELETE /api/auth/api-key/{id}`. MCP tool name: `delete_auth_api_key_id`.

#### `clika-cli auth api-key-rotate`

Rotate API key

```
clika-cli auth api-key-rotate <id> [flags]
```

Positional arguments: required `<id>`.

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `POST /api/auth/api-key/{id}/rotate`. MCP tool name: `post_auth_api_key_id_rotate`.

#### `clika-cli auth api-key-scope-catalog`

Describe the API-key scope catalogue

```
clika-cli auth api-key-scope-catalog [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `GET /api/auth/api-key/scope-catalog`. MCP tool name: `get_auth_api_key_scope_catalog`.

#### `clika-cli auth capabilities`

The caller's effective capabilities

```
clika-cli auth capabilities [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `GET /api/auth/capabilities`. MCP tool name: `get_auth_capabilities`.

#### `clika-cli auth captcha`

Captcha requirement for the credential forms

```
clika-cli auth captcha [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `GET /api/auth/captcha`. MCP tool name: `get_auth_captcha`.

#### `clika-cli auth change-password`

Change password

```
clika-cli auth change-password [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--body` | string | none | request body (inline JSON) |
| `--body-file` | string | none | request body (path to a JSON file) |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `POST /api/auth/change-password`. MCP tool name: `post_auth_change_password`.

#### `clika-cli auth check-email`

Check whether an email is already registered

```
clika-cli auth check-email [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--code` | string | none | A signup code; when it admits the address, signup_enabled is true |
| `--email` | string | none | Email address to check |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `GET /api/auth/check-email`. MCP tool name: `get_auth_check_email`.

#### `clika-cli auth cli-download-token`

Mint a CLI download token

```
clika-cli auth cli-download-token [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `POST /api/auth/cli-download-token`. MCP tool name: `post_auth_cli_download_token`.

#### `clika-cli auth forgot-password`

Request password reset

```
clika-cli auth forgot-password [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--body` | string | none | request body (inline JSON) |
| `--body-file` | string | none | request body (path to a JSON file) |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `POST /api/auth/forgot-password`. MCP tool name: `post_auth_forgot_password`.

#### `clika-cli auth invite-info`

Get invitation info

```
clika-cli auth invite-info [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |
| `--token` | string | none | Invitation token from the invite email |

Endpoint: `GET /api/auth/invite-info`. MCP tool name: `get_auth_invite_info`.

#### `clika-cli auth login`

Login

```
clika-cli auth login [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--body` | string | none | request body (inline JSON) |
| `--body-file` | string | none | request body (path to a JSON file) |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `POST /api/auth/login`. MCP tool name: `post_auth_login`.

#### `clika-cli auth logout`

Logout

```
clika-cli auth logout [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `POST /api/auth/logout`. MCP tool name: `post_auth_logout`.

#### `clika-cli auth me`

Get current user

```
clika-cli auth me [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `GET /api/auth/me`. MCP tool name: `get_auth_me`.

#### `clika-cli auth me-orgs`

List my organizations

```
clika-cli auth me-orgs [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `GET /api/auth/me/orgs`. MCP tool name: `get_auth_me_orgs`.

#### `clika-cli auth me-projects`

List my projects

```
clika-cli auth me-projects [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `GET /api/auth/me/projects`. MCP tool name: `get_auth_me_projects`.

#### `clika-cli auth oauth2-callback`

OAuth2/OIDC callback (platform-configured provider)

```
clika-cli auth oauth2-callback <provider> [flags]
```

Positional arguments: required `<provider>`.

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--code` | string | none | OAuth2 authorization code |
| `--raw` | bool | `false` | print raw response without pretty-printing |
| `--redirect_uri` | string | none | Redirect URI to present at code exchange; must equal the one used at init. Defaults to this endpoint's own URL |
| `--state` | string | none | OAuth2 state parameter, as returned by the identity provider |

Endpoint: `GET /api/auth/oauth2/{provider}/callback`. MCP tool name: `get_auth_oauth2_provider_callback`.

#### `clika-cli auth refresh`

Refresh access token

```
clika-cli auth refresh [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--body` | string | none | request body (inline JSON) |
| `--body-file` | string | none | request body (path to a JSON file) |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `POST /api/auth/refresh`. MCP tool name: `post_auth_refresh`.

#### `clika-cli auth resend-verification`

Resend verification email

```
clika-cli auth resend-verification [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--body` | string | none | request body (inline JSON) |
| `--body-file` | string | none | request body (path to a JSON file) |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `POST /api/auth/resend-verification`. MCP tool name: `post_auth_resend_verification`.

#### `clika-cli auth reset-password`

Reset password with token

```
clika-cli auth reset-password [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--body` | string | none | request body (inline JSON) |
| `--body-file` | string | none | request body (path to a JSON file) |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `POST /api/auth/reset-password`. MCP tool name: `post_auth_reset_password`.

#### `clika-cli auth saml-acs`

SAML Assertion Consumer Service

```
clika-cli auth saml-acs <provider> [flags]
```

Positional arguments: required `<provider>`.

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `POST /api/auth/saml/{provider}/acs`. MCP tool name: `post_auth_saml_provider_acs`.

#### `clika-cli auth saml-by-id-acs`

SAML Assertion Consumer Service (organization provider)

```
clika-cli auth saml-by-id-acs <provider_id> [flags]
```

Positional arguments: required `<provider_id>`.

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `POST /api/auth/saml/by-id/{provider_id}/acs`. MCP tool name: `post_auth_saml_by_id_provider_id_acs`.

#### `clika-cli auth saml-by-id-login`

Initiate SAML login (organization provider)

```
clika-cli auth saml-by-id-login <provider_id> [flags]
```

Positional arguments: required `<provider_id>`.

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |
| `--redirect_url` | string | none | URL to redirect to after successful login |

Endpoint: `GET /api/auth/saml/by-id/{provider_id}/login`. MCP tool name: `get_auth_saml_by_id_provider_id_login`.

#### `clika-cli auth saml-by-id-metadata`

SAML SP metadata (organization provider)

```
clika-cli auth saml-by-id-metadata <provider_id> [flags]
```

Positional arguments: required `<provider_id>`.

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `GET /api/auth/saml/by-id/{provider_id}/metadata`. MCP tool name: `get_auth_saml_by_id_provider_id_metadata`.

#### `clika-cli auth saml-login`

Initiate SAML login

```
clika-cli auth saml-login <provider> [flags]
```

Positional arguments: required `<provider>`.

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |
| `--redirect_url` | string | none | URL to redirect to after successful login |

Endpoint: `GET /api/auth/saml/{provider}/login`. MCP tool name: `get_auth_saml_provider_login`.

#### `clika-cli auth saml-metadata`

SAML SP metadata

```
clika-cli auth saml-metadata <provider> [flags]
```

Positional arguments: required `<provider>`.

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `GET /api/auth/saml/{provider}/metadata`. MCP tool name: `get_auth_saml_provider_metadata`.

#### `clika-cli auth sessions`

List active sessions

```
clika-cli auth sessions [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `GET /api/auth/sessions`. MCP tool name: `get_auth_sessions`.

#### `clika-cli auth sessions-delete-id`

Revoke session

```
clika-cli auth sessions-delete-id <id> [flags]
```

Positional arguments: required `<id>`.

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `DELETE /api/auth/sessions/{id}`. MCP tool name: `delete_auth_sessions_id`.

#### `clika-cli auth signup`

Sign up a new user

```
clika-cli auth signup [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--body` | string | none | request body (inline JSON) |
| `--body-file` | string | none | request body (path to a JSON file) |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `POST /api/auth/signup`. MCP tool name: `post_auth_signup`.

#### `clika-cli auth signup-codes-preview`

Preview a signup code

```
clika-cli auth signup-codes-preview [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--code` | string | none | The signup code, with or without its dashes |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `GET /api/auth/signup-codes/preview`. MCP tool name: `get_auth_signup_codes_preview`.

#### `clika-cli auth sso-authorize`

Initiate SSO login (OAuth2/OIDC)

```
clika-cli auth sso-authorize <provider> [flags]
```

Positional arguments: required `<provider>`.

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |
| `--redirect_url` | string | none | URL to redirect to after successful login |

Endpoint: `GET /api/auth/sso/{provider}/authorize`. MCP tool name: `get_auth_sso_provider_authorize`.

#### `clika-cli auth sso-callback`

OAuth2/OIDC callback

```
clika-cli auth sso-callback <provider> [flags]
```

Positional arguments: required `<provider>`.

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--code` | string | none | OAuth2 authorization code |
| `--raw` | bool | `false` | print raw response without pretty-printing |
| `--state` | string | none | OAuth2 state parameter |

Endpoint: `GET /api/auth/sso/{provider}/callback`. MCP tool name: `get_auth_sso_provider_callback`.

#### `clika-cli auth sso-check-email`

Check email domain for SSO

```
clika-cli auth sso-check-email [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--email` | string | none | Email address to check |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `GET /api/auth/sso/check-email`. MCP tool name: `get_auth_sso_check_email`.

#### `clika-cli auth sso-providers`

List public SSO providers

```
clika-cli auth sso-providers [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `GET /api/auth/sso/providers`. MCP tool name: `get_auth_sso_providers`.

#### `clika-cli auth switch-org`

Switch organization

```
clika-cli auth switch-org [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--body` | string | none | request body (inline JSON) |
| `--body-file` | string | none | request body (path to a JSON file) |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `POST /api/auth/switch-org`. MCP tool name: `post_auth_switch_org`.

#### `clika-cli auth switch-project`

Switch project

```
clika-cli auth switch-project [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--body` | string | none | request body (inline JSON) |
| `--body-file` | string | none | request body (path to a JSON file) |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `POST /api/auth/switch-project`. MCP tool name: `post_auth_switch_project`.

#### `clika-cli auth verify-email`

Verify email

```
clika-cli auth verify-email [flags]
```

| Flag | Type | Default | Meaning |
| --- | --- | --- | --- |
| `--body` | string | none | request body (inline JSON) |
| `--body-file` | string | none | request body (path to a JSON file) |
| `--raw` | bool | `false` | print raw response without pretty-printing |

Endpoint: `POST /api/auth/verify-email`. MCP tool name: `post_auth_verify_email`.

<!-- END GENERATED COMMAND REFERENCE -->

## Related

- [CLI overview](index.md): install, global flags, output formats and exit codes.
- [self-update](self-update.md): keeping the binary in step with the deployment.
- [MCP server](mcp.md): the same credentials, used by an AI assistant.