> ## Documentation Index
> Fetch the complete documentation index at: https://cralo.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate local and unattended AI agents securely.

Cralo uses device authorization when you set up an agent interactively and scoped API keys when an agent runs unattended.

Authentication commands live under `auth`. Top-level `login`, `logout`, and `status` are aliases for the same behavior.

## Interactive sign-in

```bash theme={null}
cralo auth login
```

The CLI opens a browser to complete authorization, then stores the resulting credential in your OS keychain when available. If a keychain is unavailable, it uses a protected credential file.

For a terminal where you do not want the browser opened automatically:

```bash theme={null}
cralo auth login --no-browser --json
```

The JSON result contains an `authorization_url`. Open it in a browser and wait for the CLI to finish polling.

<Tip>`cralo login` is an alias for `cralo auth login` with the same flags.</Tip>

## Status and logout

```bash theme={null}
cralo auth status --json
cralo auth logout
```

Aliases: `cralo status`, `cralo logout`.

## Unattended agents

```bash theme={null}
export CRALO_API_KEY='ot_live_<id>_<secret>'
cralo auth status --json
```

The environment value takes precedence over a stored credential, making it suitable for agents running in CI, containers, and hosted environments.

<Warning>
  Never place API keys in agent prompts, pass them as CLI flags, commit them to
  a repository, or paste them into logs. The CLI never accepts an API-key flag.
</Warning>