---
title: CLI Authentication
description: Authenticate the Capawesome Cloud CLI — log in interactively or use an API token for CI/CD with the --token flag.
---

# Authentication

Every command runs against your Capawesome Cloud account, so you need to authenticate before you can do anything useful. There are two ways to do it: an interactive login for your own machine, and an API token for automated environments.

## Interactive login

For local use, log in once. The CLI stores your credentials, so you stay logged in across commands and terminal sessions until you log out:

```bash
npx @capawesome/cli login
```

Confirm who you're logged in as at any time:

```bash
npx @capawesome/cli whoami
```

And log out to clear the stored credentials:

```bash
npx @capawesome/cli logout
```

## API tokens for CI/CD

Interactive login doesn't work on a build server, so in automated environments you authenticate with an [API token](../accounts/tokens.md) instead. Create a token in Capawesome Cloud, store it as a secret in your CI provider, and pass it with `--token`:

```bash
npx @capawesome/cli login --token $CAPAWESOME_TOKEN
```

You can pass `--token` on `login` to authenticate for the rest of the session, or on an individual command to authenticate just that one call — handy when a pipeline runs a single command.

!!! warning "Keep tokens secret"

    Never hard-code a token or commit it to version control — always read it from a CI secret or environment variable, and rotate it if it might have leaked.

## Next steps

- [Usage](usage.md) — global flags (including `--token`) and JSON output.
- [Examples](examples.md) — CI recipes that authenticate with a token.
- [API tokens](../accounts/tokens.md) — create and manage the tokens you authenticate with.