Logging in

auth login is a browser approval. You confirm a one-time code, and the CLI creates an API key and stores it for the commands that follow. Every later command is an ordinary API key request.

Log in#

npx @mynthio/cli auth login

On a desktop terminal the CLI opens the approval page and prints the URL. When the page already shows a code, confirm it matches the terminal. When it asks you to type one, enter the code the CLI printed. Over SSH, in CI, when output is piped, or with --no-browser, the CLI only prints the URL.

The approval is used once, to create a key named mynth-cli (<hostname>). Its default scopes are generate, manage, and keys. Narrow them at login:

npx @mynthio/cli auth login --scopes generate,manage

The key is listed in the dashboard with your other keys. Set a spending limit there if this machine is shared. Authentication is the scope list.

If MYNTH_API_KEY is already set, auth login exits 3 and does not start the browser flow. Unset it, or keep using the variable.

Where the key is stored#

The file is ~/.config/mynth/credentials.json, mode 0600. When XDG_CONFIG_HOME is set, the directory is $XDG_CONFIG_HOME/mynth instead. The file holds the API key and its id. The name, the scopes, and the spending limit stay on the server, and whoami reads them live. Nothing from the browser session is written next to the key.

To store a key you already have, skip the browser:

npx @mynthio/cli config set api-key -

The - reads the key from stdin. That copy has no id in the file, so auth logout leaves it active on the account and only removes the local copy.

Which key is used#

When MYNTH_API_KEY is set, every command sends that key. The file is not read.

With the variable unset, commands send the stored key. With neither, the CLI exits 3 and tells you to run auth login or set MYNTH_API_KEY.

GET /balance needs the manage scope. A generate-only key cannot read it, and balance exits 3 with INSUFFICIENT_SCOPE. balance works after auth login, because that key includes manage unless you narrowed --scopes.

Check and sign out#

npx @mynthio/cli auth status
npx @mynthio/cli whoami
npx @mynthio/cli auth logout

auth status reports whether the credential is the environment variable or the file. It does not call the API. whoami calls GET /me, so a revoked key fails here instead of halfway through a generation. The same command is auth whoami.

auth logout revokes the key this login created, then deletes the file. A key you stored with config set api-key is cleared locally and left active. Revoke that one in the dashboard, or with api-key delete. While MYNTH_API_KEY is set, logout cannot see the stored key, so it still deletes the file, leaves that key active, and warns that the variable will be used.

config unset api-key deletes the file and does not revoke anything.

Next#

• Commands: what to run once you are signed in.
• Authentication: scopes, spending limits, and mak_ keys.