> ## Documentation Index
> Fetch the complete documentation index at: https://opentooler.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate local and unattended AI agents securely.

OpenTooler uses device authorization when you set up an agent interactively and scoped API keys when an agent runs unattended.

Authentication commands live under `auth`. Top-level `login`, `logout`, and `status` are aliases for the same behavior.

## Interactive sign-in

```bash theme={null}
opentooler auth login
```

The CLI opens a browser to complete authorization, then stores the resulting credential in your OS keychain when available. If a keychain is unavailable, it uses a protected credential file.

For a terminal where you do not want the browser opened automatically:

```bash theme={null}
opentooler auth login --no-browser --json
```

The JSON result contains an `authorization_url`. Open it in a browser and wait for the CLI to finish polling.

<Tip>
  `opentooler login` is an alias for `opentooler auth login` with the same
  flags.
</Tip>

## Status and logout

```bash theme={null}
opentooler auth status --json
opentooler auth logout
```

Aliases: `opentooler status`, `opentooler logout`.

## Unattended agents

```bash theme={null}
export OPENTOOLER_API_KEY='ot_live_<id>_<secret>'
opentooler auth status --json
```

The environment value takes precedence over a stored credential, making it suitable for agents running in CI, containers, and hosted environments.

<Warning>
  Never place API keys in agent prompts, pass them as CLI flags, commit them to
  a repository, or paste them into logs. The CLI never accepts an API-key flag.
</Warning>