Skip to main content

Authentication

Authenticate the Dwellir CLI before managing keys, viewing usage, or accessing account data. The method depends on your environment.

Browser login (interactive)#

For local development, open a browser-based login flow:

dwellir auth login

This opens your default browser to the Dwellir dashboard. After you sign in, the CLI receives a token via a local callback and stores it in your profile.

Token login (headless / CI)#

For CI/CD pipelines, Docker containers, or any environment without a browser, pass a token directly:

dwellir auth login --token <YOUR_CLI_TOKEN>

Alternatively, set the token as an environment variable:

export DWELLIR_TOKEN=<YOUR_CLI_TOKEN>

When DWELLIR_TOKEN is set, the CLI uses it for every command without needing dwellir auth login.

Getting a CLI token#

  1. Go to dashboard.dwellir.com
  2. Navigate to Settings > CLI Tokens (or the Agents page)
  3. Click Create Token, give it a name, and copy the value
  4. Store the token securely (e.g., as a CI secret)

Check auth status#

See who you are logged in as and which profile is active:

dwellir auth status
dwellir auth status --json
{
  "ok": true,
  "data": {
    "profile": "default",
    "user": "you@example.com",
    "org": "Your Organization"
  }
}

The user and org fields are populated when authenticating via the browser flow. Token-based authentication may return empty values for these fields depending on the token type.

Print the resolved access token to stdout, useful for piping into other tools:

dwellir auth token

For example, to pass the Dwellir token to another script:

export TOKEN=$(dwellir auth token)

Logout#

Remove local credentials for the active profile:

dwellir auth logout

This deletes the profile file from ~/.config/dwellir/profiles/. It does not revoke the token on the server.

Token resolution order#

When the CLI needs an auth token, it checks these sources in order:

  1. DWELLIR_TOKEN environment variable
  2. --token flag passed to the command
  3. Profile file (resolved via the profile resolution chain below)

The first source that provides a non-empty token wins.

Profile resolution order#

When the CLI needs to determine which profile to load, it checks:

  1. --profile flag
  2. DWELLIR_PROFILE environment variable
  3. .dwellir.json file in the current directory or any parent directory
  4. default_profile setting in ~/.config/dwellir/config.json
  5. "default" as a fallback

Multiple profiles#

You can maintain separate profiles for different accounts or organizations:

# Login to a "work" profile
dwellir auth login --profile work

# Login to a "personal" profile
dwellir auth login --profile personal

# Use a specific profile for one command
dwellir keys list --profile work

Per-project profile binding#

Create a .dwellir.json file in your project root to automatically select a profile when you run commands from that directory:

{ "profile": "work" }

Now any dwellir command run inside that project tree uses the work profile without needing the --profile flag.

Next steps#