Skip to main content
Cralo uses device authorization when you set up an agent interactively and scoped API keys when an agent runs unattended. Authentication commands live under auth. Top-level login, logout, and status are aliases for the same behavior.

​
Interactive sign-in

The CLI opens a browser to complete authorization, then stores the resulting credential in your OS keychain when available. If a keychain is unavailable, it uses a protected credential file. For a terminal where you do not want the browser opened automatically:
The JSON result contains an authorization_url. Open it in a browser and wait for the CLI to finish polling.
cralo login is an alias for cralo auth login with the same flags.

​
Status and logout

Aliases: cralo status, cralo logout.

​
Unattended agents

The environment value takes precedence over a stored credential, making it suitable for agents running in CI, containers, and hosted environments.
Never place API keys in agent prompts, pass them as CLI flags, commit them to a repository, or paste them into logs. The CLI never accepts an API-key flag.