> ## Documentation Index
> Fetch the complete documentation index at: https://docs.machina.gg/llms.txt
> Use this file to discover all available pages before exploring further.

# login

> Authenticate the CLI: browser SSO, API key, or username/password.

`machina login` authenticates the CLI and stores credentials locally. The related `auth` subcommands inspect and clear that session. For the full picture, see the [Authentication guide](/cli/guide/authentication).

## Usage

```bash theme={null}
machina login                          # browser-based SSO (default)
machina login --api-key <key>          # authenticate with an API key (CI/CD)
machina login --with-credentials       # username / password
machina login --no-interactive         # don't open the REPL afterwards

machina auth whoami                    # show the current user
machina auth logout                    # clear stored credentials
```

## Options

| Flag                 | Short | Description                                         |
| -------------------- | ----- | --------------------------------------------------- |
| `--api-key`          | `-k`  | Authenticate with an API key instead of the browser |
| `--with-credentials` |       | Use username / password instead of the browser      |

## Behavior

* Browser login opens your browser for Clerk SSO / magic-link sign-in, then stores the session in `~/.machina/credentials.json` (`600`).
* After a successful login the CLI opens the [interactive REPL](/cli/guide/repl). Pass `--no-interactive` to skip it — useful in scripts.
* For CI, prefer `--api-key` or the `MACHINA_API_KEY` environment variable.
* `--api-key` stores the key and **keeps it even if the server can't confirm it** — some account auth endpoints only accept a *session* token, so verification can be inconclusive; the key is never silently discarded. Use an **account-level** API key here. A *project-scoped* key won't authenticate the account login — use it via `MACHINA_API_KEY` for project commands, or [`connect --mint`](/cli/commands/connect) to wire an external agent.

<Tip>
  In CI, set `MACHINA_API_KEY` instead of calling `machina login` — every command picks the key up automatically with no interactive step.
</Tip>