Sign in

The CLI uses the same Cortex account as the web app. Sign in once per machine; the session is stored in your operating system’s keyring.

cortex login

Cortex prints a verification URL and opens it in your browser. Approve the sign-in there and the CLI picks up the session. From inside the TUI, /login does the same without leaving your session; the inline screen offers Continue with browser or Paste an API key.

Welcome to Cortex CLI — How would you like to log in? Continue with browser or Paste an API key — The inline sign-in picker: Continue with browser, or Paste an API key. Numbered rows, arrow keys to select, Enter to confirm.

A machine without a browser

cortex login --device-auth

Cortex prints a short code and a URL. Open the URL on any device that has a browser, enter the code, and the CLI continues when the sign-in is approved. Good for servers, containers, and remote shells.

Waiting for browser authentication with a device code shown — Waiting for the browser: the code to enter, and the URL to visit if the browser did not open. Esc cancels.

Unattended use: API key or token

For CI and other unattended runs, do not use the browser flow.

# read an API key from stdin — never from the command line
printf '%s' "$CORTEX_API_KEY" | cortex login --with-api-key

# or pass a token your CI secret store populates
cortex login --token "$CORTEX_AUTH_TOKEN"

Or skip cortex login entirely and set the variable for the job:

Variable	Purpose
`CORTEX_API_KEY`	API key for headless and CI use
`CORTEX_AUTH_TOKEN`	A session or bearer token
`CORTEX_API_URL`	The API base URL, if your deployment differs from `https://api.cortex.foundation`

Take the value from your CI secret store. Never write it into a workflow file or commit it.

Enterprise SSO

cortex login --sso is available for organisations that sign in through single sign-on. The web app’s sign-in dialog offers the same Single sign-on (SSO) route.

Check and sign out

cortex whoami          # the signed-in account
cortex login status    # the state of the stored session
cortex logout          # asks first
cortex logout --yes
cortex logout --all    # every stored credential

In the TUI: /account (aliases /whoami, /me), /login, /logout.

Where credentials are stored

Platform	Store
macOS	Keychain
Linux	Secret Service — GNOME Keyring, KWallet, and compatible providers
Windows	Credential Manager

Credentials are deliberately not written to a plaintext file in your home directory, and never into the repository. If no keyring is available — a bare container, a headless CI runner — use CORTEX_API_KEY or CORTEX_AUTH_TOKEN instead of trying to make one work.

Troubleshooting

Symptom	Cause	Fix
The coding service is temporarily unavailable during sign-in	The CLI could not reach `api.cortex.foundation`	Check network access and proxies. The message is deliberately the whole story — Cortex does not surface provider or transport names.
Sign-in succeeds but `cortex whoami` fails	The keyring did not persist the session	On Linux, check that a Secret Service provider is running; otherwise fall back to `CORTEX_API_KEY`
A CI job cannot sign in	It tried the browser flow	Use `--with-api-key`, `--token`, or set `CORTEX_API_KEY` in the job environment
The TUI asks you to sign in again	The stored session expired or was cleared	`cortex login`

Install
Configuration — every environment variable the CLI reads.
Accounts — what a signed-in account unlocks everywhere.

⌘I

Getting started

Working in the terminal

Automation

Customize

Help

A machine without a browser

Unattended use: API key or token

Enterprise SSO

Check and sign out

Where credentials are stored

Troubleshooting

​Browser sign-in (default)

​A machine without a browser

​Unattended use: API key or token

​Enterprise SSO

​Check and sign out

​Where credentials are stored

​Troubleshooting

​Related

Browser sign-in (default)

A machine without a browser

Unattended use: API key or token

Enterprise SSO

Check and sign out

Where credentials are stored

Troubleshooting

Related