Authentication

The CLI uses the same authentication as the dashboard. You log in once via the browser, and the CLI manages session tokens automatically.

Login

cloudsignal login

How it works:

1. The CLI opens your default browser to the CloudSignal dashboard login page
2. You authenticate using your existing credentials (email/password, Google, etc.)
3. After login, the dashboard securely passes session tokens back to the CLI
4. Tokens are stored locally at ~/.cloudsignal/credentials.json

Session Tokens

After login, the CLI stores two tokens:

The CLI handles token refresh automatically. When your access token expires, the next command silently refreshes it using the refresh token.

If the refresh token also expires, you'll see:

Error: Session expired. Run `cloudsignal login` again.

Check Auth Status

cloudsignal whoami

Output:

Email: you@example.com
Organization: 550e8400-e29b-41d4-a716-446655440000
Token expires: in 47 minutes

Logout

cloudsignal logout

This deletes ~/.cloudsignal/credentials.json. You'll need to run cloudsignal login again before using other commands.

Security

• Tokens are stored with 0600 file permissions (owner read/write only)
• The CLI's local callback server only binds to 127.0.0.1
• The dashboard validates redirect URIs are localhost only
• Tokens are passed directly from the dashboard - no third-party services exposed

Troubleshooting

"Login timed out"

The browser auth flow must complete within 5 minutes. If it times out:

1. Check that your browser opened the login page
2. Make sure no firewall is blocking localhost connections
3. Try again with cloudsignal login

Browser doesn't open

On headless servers or WSL, the CLI may not be able to open a browser. Copy the URL from the terminal output and open it manually.