Skip to main content
The CLI supports two auth modes: browser-based session login for interactive use and a project API key for CI and headless environments.

​
inf auth login

Sign in through your browser using the OAuth 2.0 device authorization flow. Opens a verification URL, displays a user code, and polls until you approve in the browser.
After sign-in, the CLI stores a session token in ~/.inf/config.json and activates an organization (team). If your account belongs to multiple teams, inf auth login prompts you to choose one in an interactive terminal.

​
Options

​
Team selection

Use --team when you know which team you want to activate, or when running in a non-interactive shell.
You can pass a team ID, slug, or exact team name:
If the selected team is different from the previously active team, the CLI clears the stored active project and then tries to auto-select a project from the newly active team. You can always run inf project list and inf project switch <id> to pick a different project.
inf auth login --team only sets the team activated at sign-in. Once signed in, you have two ways to work with a different team without signing in again: inf team switch <id-or-slug> stores a new active team in your config, while the global -t, --team <id> flag (or INF_TEAM_ID) overrides the team for a single command only and does not change your stored active team. See Teams.
In non-interactive environments, inf auth login cannot prompt for a team. If you belong to multiple teams and omit --team, the CLI falls back to the first team returned by the auth API. Pass --team <id-or-slug> to make the selected team deterministic.
Session login requires a browser, so inf auth login is not suitable for CI or other headless environments. Use inf auth set-key or the INF_API_KEY env var there instead.

​
inf auth set-key

Store a project API key on disk for headless or CI authentication.

​
Arguments

After saving, the CLI validates the key by fetching the project list. A successful fetch auto-selects the first project as active.

​
Example

​
inf auth status

Show who you’re signed in as, which auth method the CLI is using, the active team and project, and the API URL.

​
inf auth whoami

Show your user ID, email, name, and the team the next command will target.
Use inf auth status for a broader view that also includes the auth method and active project. Use whoami when you only need identity and team, for example in a script.
With a project API key, whoami shows your user ID and team but not your email or name, since a project API key is not tied to a specific person.

​
inf auth logout

Sign out, clear the session token / API key from ~/.inf/config.json, and forget the active project and team.

​
Credential resolution order

When multiple credentials are present, the CLI picks the first match:
  1. INF_API_KEY environment variable
  2. API key stored via inf auth set-key
  3. Session token stored via inf auth login
inf instrument is the one exception — it rejects INF_API_KEY and requires a session login, because it needs to fetch your project’s default API key on your behalf. Unset INF_API_KEY and run inf auth login before running inf instrument.

​
Configuration

The CLI stores configuration at ~/.inf/config.json, created automatically on first login. Tokens are stored with 0600 permissions.

​
Environment variables

--team and INF_TEAM_ID take a team ID, not a slug or name. Use inf team switch <id-or-slug> once to resolve a slug or name to an ID, or run inf team list to look one up.