> ## Documentation Index
> Fetch the complete documentation index at: https://platform.atlan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# atlanai auth

> Authenticate with the Gateway and inspect or clear credential state.

Use `auth` for browser login and local credential management. For headless
environments, set `ATLANAI_TOKEN` instead.

No `auth` subcommand accepts positional arguments unless shown below.

## Commands

### login

Opens browser authentication and stores the resulting refresh credential in
the operating system's supported credential store.

**Usage**

```text theme={null}
atlanai auth login
```

If `ATLANAI_TOKEN` is set, login stops because that environment credential
would shadow the stored session.

### status

Shows whether the CLI has a usable credential and where it came from.

**Usage**

```text theme={null}
atlanai auth status [flags]
```

| Option             | Type        | Default | Description                                                                            |
| ------------------ | ----------- | ------- | -------------------------------------------------------------------------------------- |
| `--json`           | string list | none    | Output selected fields: `email`, `gateway`, `orgID`, `state`, `tokenSource`, `userID`. |
| `--jq`, `-q`       | string      | none    | Filter JSON output with a jq expression.                                               |
| `--template`, `-t` | string      | none    | Render JSON data with a Go template.                                                   |

Returns exit code `4` when no usable credential exists.

### logout

Removes the stored session and clears the credential held by the running daemon.

**Usage**

```text theme={null}
atlanai auth logout
```

An unreachable daemon falls back to local credential removal; a daemon that
answers but refuses keeps the command from claiming sign-out succeeded.

### token

Prints a stored bearer token for another local process.

**Usage**

```text theme={null}
atlanai auth token
```

The command refuses to print `ATLANAI_TOKEN` from the environment.

## Examples

```bash theme={null}
atlanai auth login
atlanai auth status --json state,tokenSource,gateway,userID,orgID
```

Headless authentication:

```bash theme={null}
export ATLANAI_TOKEN="<api-key>"
atlanai auth status
```

## Output and behavior

* `auth status` prints state, token source, Gateway, and resolved identity. It
  never prints the credential.
* `auth token` writes the token to stdout. Treat it as a secret and do not put
  it in logs, prompts, or source control.
* `ATLANAI_TOKEN` accepts an API key or bearer token and takes precedence over
  stored OAuth credentials.
* After changing `ATLANAI_TOKEN`, run `atlanai daemon stop` so the next hook
  starts the daemon with the new value.

## Related

* [Get started with the CLI](/cli/get-started)
* [Automation and exit codes](/cli/api-automation)
* [`atlanai context`](/cli/reference/context)