> ## Documentation Index
> Fetch the complete documentation index at: https://runinfra.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# CLI sign-in and security

> Sign in, review terminal access, and save your credential.

Sign in to connect agents to your workspace.
Re-login saves the new terminal key, then revokes this machine's previous terminal key.
This guide covers CLI 0.3.0.

## Choose how to sign in

| Method      | Command                   | Action                                                                  |
| ----------- | ------------------------- | ----------------------------------------------------------------------- |
| Browser     | `runinfra login`          | Approve the request in your browser.                                    |
| Device code | `runinfra login --device` | Open the displayed address on another device and enter the public code. |
| Shared key  | `runinfra login --paste`  | Paste a workspace key into the masked field.                            |

The standalone login command saves the credential after successful approval or key validation.
In the full-screen app, you review and approve saving separately.
Connecting agents always needs a separate approval.

The CLI requests one automatic browser launch.
If no page opens, open the displayed address or choose **Open browser**.
Use device approval when a local browser callback is unavailable.
Use a shared key if the deployment says browser sign-in is unavailable.
Agents connected with a pasted key use that shared key.

A browser **approval code** is the complete 43-character code for the active request.
It is different from the public device code and a workspace API key.

## Review the workspace and permissions

Browser and device approval require a workspace you own.
Choose it explicitly and approve only the request you started.

Terminal access lasts **90 days** and permits:

* Reading account details, credits, usage, and models.
* Managing eligible agent keys across the workspace, including their spending limits and keys created from other terminals.

The terminal key cannot make billable model requests itself.
Agent keys remain active until separately revoked or expired.
Selecting agents does not restrict terminal permission to those agents.

In the full-screen app:

1. Read **Review approved credential** or **Review shared credential**.
2. Check the identity, workspace, role, expiry, and permissions.
3. Read to the end.
4. Press **Enter** with save selected or press **y**.

Checking a pasted key or approval code does not save it in this view.
Unread or clipped details block saving.
Held or pasted keys never approve.

## Read the funding line

After saving, the app can show an existing plan's funding line.
If your workspace has no plan, you can [choose how to pay](/docs/tools-sdks/connect-coding-plan#choose-how-to-pay).
The question appears once per workspace on this machine when you can manage its plan and sales are open.
Run `runinfra plan` to check availability.
A failed plan read does not undo a saved sign-in.

## What is stored locally

The CLI stores your credential, connection records, and recovery information.
Agent keys and settings are saved when the separately approved connection runs.
Recovery snapshots can retain old keys.

On re-login, the review names the key it replaces before you approve:

> Replaces `<key prefix>` on this machine. It is revoked after the new key is saved.

Saving the new credential comes first.
If saving fails, the previous terminal key stays active.
On Windows, saving stops if private file permissions cannot be confirmed, and the previous file stays unchanged.
If revocation fails, the new sign-in stays saved and the CLI reports:

> The previous terminal credential could not be revoked; remove it in Settings, API keys.

A replaced shared key stays active.
Check its other users before revoking it.
`credentials.json` accepts a leading byte-order mark.

Follow any file-privacy warning at the reported path.
See [CLI troubleshooting](/docs/tools-sdks/connect-troubleshooting#sign-in-messages) for an unconfirmed save.

Keys are never accepted as command-line arguments.
Normal screens show prefixes.
An acknowledged manual key reveal lasts up to **20 seconds**; leaving it hides the key.
Full keys do not appear in receipts or saved logs.

## Revoke terminal access

Use **Settings > API keys > Terminal sessions** to revoke terminal access before expiry.
Agent keys remain separately active.

| Command                            | Result                                                                                                       |
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| `runinfra logout`                  | Review server revocation and local removal.                                                                  |
| `runinfra logout --disconnect-all` | Review deleting profiles, sessions included, or restoring in-place settings before sign-out.                 |
| `runinfra logout --local`          | Remove local sign-in without server revocation.                                                              |
| `runinfra keys revoke <name>`      | Review deleting the named profile, sessions included, or restoring in-place settings, then revoking its key. |

Profile removal deletes the whole folder, including sessions and history. Copy what you need first.

Logout reports server revocation and local deletion separately.
Unconfirmed agent revocation during `--disconnect-all` keeps terminal credentials for recovery.
Use Doctor to finish [pending revocations](/docs/tools-sdks/connect-troubleshooting#finish-a-pending-revocation).