> ## Documentation Index
> Fetch the complete documentation index at: https://repost.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and configuration

> Repost CLI authentication methods, credential storage, token lookup order, and configuration.

The CLI authenticates to your Repost account with an API token. Choose a method based on where you run it, then control where credentials and configuration live. New to the CLI? Start with the [Quickstart](/docs/cli/quickstart).

## Authentication methods

<Tabs>
  <Tab title="Browser login" icon="globe">
    `repost auth login` opens the Repost app in your browser, waits for a local callback, then stores the generated API token securely. The browser flow waits for up to 5 minutes.

    ```bash theme={"languages":{"custom":["/languages/repost.json"]}}
    repost auth login
    ```

    Use this on your own workstation. If a token is already saved, `repost auth login` keeps the existing token and asks you to run `repost auth logout` before switching accounts.
  </Tab>

  <Tab title="API token" icon="key-round">
    `repost auth token` stores an API token without opening a browser. The command accepts the token as an argument, from stdin, or from an interactive prompt.

    <CodeGroup>
      ```bash Argument theme={"languages":{"custom":["/languages/repost.json"]}}
      repost auth token rp_your_token_here
      ```

      ```bash Stdin theme={"languages":{"custom":["/languages/repost.json"]}}
      printf "%s\n" "$REPOST_TOKEN" | repost auth token
      ```
    </CodeGroup>

    Create tokens from the dashboard when you need a named, expiring credential for a workstation or automation. See [API tokens](/docs/workspace/tokens).

    Tokens must start with `rp_` and be `43` characters long.
  </Tab>

  <Tab title="CI" icon="workflow">
    For CI or short-lived environments, set `REPOST_TOKEN`. Environment authentication takes priority over stored credentials.

    ```bash theme={"languages":{"custom":["/languages/repost.json"]}}
    export REPOST_TOKEN=rp_your_token_here
    repost auth status
    ```
  </Tab>
</Tabs>

## Credential storage

<Columns cols={3} className="gap-y-4">
  <Card title="System keychain first" icon="shield-check">
    The CLI uses macOS Keychain, Windows Credential Manager, or a Linux keyring when available.
  </Card>

  <Card title="Encrypted file fallback" icon="lock-keyhole">
    If a system keychain is unavailable, the CLI stores an encrypted token in the config directory.
  </Card>

  <Card title="Environment wins" icon="terminal">
    `REPOST_TOKEN` overrides any token saved by `repost auth login` or `repost auth token`.
  </Card>
</Columns>

## Token lookup order

The CLI reads credentials in this order:

| Source         | When it is used                                                                  |
| -------------- | -------------------------------------------------------------------------------- |
| `REPOST_TOKEN` | Set this for CI, scripts, and temporary shells. It overrides stored credentials. |
| Secure storage | Created by `repost auth login` or `repost auth token`.                           |

Clear `REPOST_TOKEN` before testing a token saved on your machine.

## Verify or remove authentication

<CodeGroup>
  ```bash Check status theme={"languages":{"custom":["/languages/repost.json"]}}
  repost auth status
  ```

  ```bash Log out theme={"languages":{"custom":["/languages/repost.json"]}}
  repost auth logout
  ```
</CodeGroup>

`repost auth status` validates the token when the server is reachable. If a stored token was revoked, the CLI removes the local copy and asks you to authenticate again.

If the server cannot be reached, `repost auth status` falls back to local state. It shows the configured auth method and the config directory, but it cannot prove that the token is still valid.

<Note>
  `repost auth logout` attempts to revoke the stored token on the server, then removes the token saved in secure storage. It does not unset `REPOST_TOKEN`; clear that environment variable separately for CI or temporary shells.
</Note>

## Configuration location

The CLI stores local preferences in an operating-system-specific config directory. The same directory is used for encrypted token fallback when a system keychain is unavailable.

`--config` has the highest priority. `REPOST_CONFIG_DIR` is the environment equivalent.

```bash theme={"languages":{"custom":["/languages/repost.json"]}}
repost --config ./tmp/repost-cli auth status
```

The config file stores local state such as the CLI session ID, preferred type-generation language, and generation options. Service URLs are resolved at runtime from build defaults or environment overrides.

`REPOST_BASE_URL` derives all service URLs from one base domain. More specific variables override that derived value.

| Variable         | Derived value when `REPOST_BASE_URL=example.com` |
| ---------------- | ------------------------------------------------ |
| `REPOST_API_URL` | `https://cli.example.com`                        |
| `REPOST_WEB_URL` | `https://app.example.com`                        |
| `REPOST_WS_URL`  | `wss://ws.example.com/ws`                        |