Docs

apivault login

The apivault login command connects this device to your account. Sign-in happens in your browser, not the terminal, so the CLI never sees your password or second factor.

Usage

LoginShell
apivault login

Opens a browser to approve the CLI's connection to your account, then waits until you approve or deny it.

How approval works

  1. Initiate pairing in terminal

    Run apivault login in your terminal.

  2. Review device in browser

    The CLI automatically opens /cli/connect displaying the requesting device identifier and IP address (redirects to sign-in first if needed).

  3. Approve connection

    Click Approve to issue a CLI token saved to ~/.apivault/token.json, or Refuse to reject access.

The device token

The token this creates expires 90 days after approval, and login prints the expiry date once it succeeds. Once expired, commands report the date the token lapsed and apivault login issues a fresh one. Expiry dates for every connected CLI are listed under Settings → Sessions & Devices, where a token can also be revoked early.

The token is saved to ~/.apivault/token.json, with owner-only permissions on Unix. CLI tokens are separate from MCP OAuth tokens — revoking one does not affect the other.

Approval timeout

The CLI waits 300 seconds for approval by default. Change it with the global --timeout option:

Longer timeoutShell
apivault --timeout 600 login

If the wait runs out, or the request expires or was already used, run apivault login again.

Service tokens

login refuses to run while APIVAULT_TOKEN is set, because every command would keep using the service token and ignore the new device token. Pipelines authenticate with a service token instead of logging in — see CI/CD & service tokens.

Global options

apivault login also accepts the global options, including --timeout.