The CLI supports two auth modes: browser-based session login for interactive use and a project API key for CI and headless environments.
inf auth login
Sign in through your browser using the OAuth 2.0 device authorization flow. Opens a verification URL, displays a user code, and polls until you approve in the browser.
After sign-in, the CLI stores a session token in ~/.inf/config.json and activates an organization (team). If your account belongs to multiple teams, inf auth login prompts you to choose one in an interactive terminal.
Options
| Option | Required | Description |
|---|
--team <id-or-slug> | No | Activate a specific team by ID, slug, or exact team name |
Team selection
Use --team when you know which team you want to activate, or when running in a non-interactive shell.
inf auth login --team acme
inf auth login --team team_abc123
inf auth login --team acme
inf auth login --team "Acme Research"
inf project list and inf project switch <id> to pick a different project.
In non-interactive environments, inf auth login cannot prompt for a team. If you belong to multiple teams and omit --team, the CLI falls back to the first team returned by the auth API. Pass --team <id-or-slug> to make the selected team deterministic.
Session login requires a browser, so inf auth login is not suitable for CI or other headless environments. Use inf auth set-key or the INF_API_KEY env var there instead.
inf auth set-key
Store a project API key on disk for headless or CI authentication.
Arguments
| Argument | Required | Description |
|---|
key | Yes | A project API key (starts with sk-inference-) |
Example
inf auth set-key sk-inference-...
inf auth status
Show who you’re signed in as, which auth method the CLI is using, the active team and project, and the API URL.
inf auth logout
Sign out, clear the session token / API key from ~/.inf/config.json, and forget the active project and team.
Credential resolution order
When multiple credentials are present, the CLI picks the first match:
INF_API_KEY environment variable- API key stored via
inf auth set-key
- Session token stored via
inf auth login
inf instrument is the one exception — it rejects INF_API_KEY and requires a session login, because it needs to fetch your project’s default API key on your behalf. Unset INF_API_KEY and run inf auth login before running inf instrument.
Configuration
The CLI stores configuration at ~/.inf/config.json, created automatically on first login. Tokens are stored with 0600 permissions.
Environment variables
| Variable | Description | Default |
|---|
INF_API_KEY | API key for authentication. Takes precedence over stored credentials | — |
INF_API_URL | Override the API base URL | https://observability-api.inference.net |
INF_PROJECT_ID | Override the active project for any invocation (equivalent to --project <id> global) | — |
