# Logging in

> Approve a one-time code in the browser. The CLI stores an API key on this machine.

`auth login` is a browser approval. You confirm a one-time code, and the CLI
creates an API key and stores it for the commands that follow. Every later
command is an ordinary API key request.

## Log in

```bash
npx @mynthio/cli auth login
```

On a desktop terminal the CLI opens the approval page and prints the URL.
When the page already shows a code, confirm it matches the terminal. When it
asks you to type one, enter the code the CLI printed. Over SSH, in CI, when
output is piped, or with `--no-browser`, the CLI only prints the URL.

The approval is used once, to create a key named `mynth-cli (<hostname>)`.
Its default scopes are `generate`, `manage`, and `keys`. Narrow them at login:

```bash
npx @mynthio/cli auth login --scopes generate,manage
```

The key is listed in the [dashboard](https://mynth.io/dashboard/keys) with your other keys.
Set a spending limit there if this machine is shared.
[Authentication](https://mynth.io/docs/authentication.md) is the scope list.

If `MYNTH_API_KEY` is already set, `auth login` exits 3 and does not start
the browser flow. Unset it, or keep using the variable.

## Where the key is stored

The file is `~/.config/mynth/credentials.json`, mode `0600`. When
`XDG_CONFIG_HOME` is set, the directory is `$XDG_CONFIG_HOME/mynth` instead.
The file holds the API key and its id. The name, the scopes, and the spending
limit stay on the server, and `whoami` reads them live. Nothing from the
browser session is written next to the key.

To store a key you already have, skip the browser:

```bash
npx @mynthio/cli config set api-key -
```

The `-` reads the key from stdin. That copy has no id in the file, so
`auth logout` leaves it active on the account and only removes the local
copy.

## Which key is used

When `MYNTH_API_KEY` is set, every command sends that key. The file is not
read.

With the variable unset, commands send the stored key. With neither, the CLI
exits 3 and tells you to run `auth login` or set `MYNTH_API_KEY`.

`GET /balance` needs the `manage` scope. A generate-only key cannot read it,
and `balance` exits 3 with `INSUFFICIENT_SCOPE`. `balance` works after
`auth login`, because that key includes `manage` unless you narrowed
`--scopes`.

## Check and sign out

```bash
npx @mynthio/cli auth status
npx @mynthio/cli whoami
npx @mynthio/cli auth logout
```

`auth status` reports whether the credential is the environment variable or
the file. It does not call the API. `whoami` calls `GET /me`, so a revoked
key fails here instead of halfway through a generation. The same command is
`auth whoami`.

`auth logout` revokes the key this login created, then deletes the file. A
key you stored with `config set api-key` is cleared locally and left active.
Revoke that one in the dashboard, or with `api-key delete`. While
`MYNTH_API_KEY` is set, logout cannot see the stored key, so it still deletes
the file, leaves that key active, and warns that the variable will be used.

`config unset api-key` deletes the file and does not revoke anything.

## Next

- [Commands](https://mynth.io/docs/sdks/cli/commands.md): what to run once you are signed in.
- [Authentication](https://mynth.io/docs/authentication.md): scopes, spending limits, and `mak_` keys.