Choose how to sign in
The standalone login command saves the credential after successful approval or key validation.
In the full-screen app, you review and approve saving separately.
Connecting agents always needs a separate approval.
The CLI requests one automatic browser launch.
If no page opens, open the displayed address or choose Open browser.
Use device approval when a local browser callback is unavailable.
Use a shared key if the deployment says browser sign-in is unavailable.
Agents connected with a pasted key use that shared key.
A browser approval code is the complete 43-character code for the active request.
It is different from the public device code and a workspace API key.
Review the workspace and permissions
Browser and device approval require a workspace you own. Choose it explicitly and approve only the request you started. Terminal access lasts 90 days and permits:- Reading account details, credits, usage, and models.
- Managing eligible agent keys across the workspace, including their spending limits and keys created from other terminals.
- Read Review approved credential or Review shared credential.
- Check the identity, workspace, role, expiry, and permissions.
- Read to the end.
- Press Enter with save selected or press y.
Read the funding line
After saving, the app can show an existing plan’s funding line. If your workspace has no plan, you can choose how to pay. The question appears once per workspace on this machine when you can manage its plan and sales are open. Runruninfra plan to check availability.
A failed plan read does not undo a saved sign-in.
What is stored locally
The CLI stores your credential, connection records, and recovery information. Agent keys and settings are saved when the separately approved connection runs. Recovery snapshots can retain old keys. On re-login, the review names the key it replaces before you approve:
Replaces <key prefix> on this machine. It is revoked after the new key is saved.
Saving the new credential comes first.
If saving fails, the previous terminal key stays active.
On Windows, saving stops if private file permissions cannot be confirmed, and the previous file stays unchanged.
If revocation fails, the new sign-in stays saved and the CLI reports:
The previous terminal credential could not be revoked; remove it in Settings, API keys.A replaced shared key stays active. Check its other users before revoking it.
credentials.json accepts a leading byte-order mark.
Follow any file-privacy warning at the reported path.
See CLI troubleshooting for an unconfirmed save.
Keys are never accepted as command-line arguments.
Normal screens show prefixes.
An acknowledged manual key reveal lasts up to 20 seconds; leaving it hides the key.
Full keys do not appear in receipts or saved logs.
Revoke terminal access
Use Settings > API keys > Terminal sessions to revoke terminal access before expiry. Agent keys remain separately active.
Profile removal deletes the whole folder, including sessions and history. Copy what you need first.
Logout reports server revocation and local deletion separately.
Unconfirmed agent revocation during
--disconnect-all keeps terminal credentials for recovery.
Use Doctor to finish pending revocations.