Authenticate the CLI

Browser login (default)

The CLI ships with the same browser OAuth UX as Claude Code. autousers login opens your default browser, signs you in to autousers.ai, and persists a short-lived OAuth access token + refresh token to ~/.autousers/config.json. The CLI silently refreshes the token when it expires.

autousers login

Opens browser → consent screen → done

Under the hood: PKCE (RFC 7636) + RFC 8707 audience-bound JWT to <base-url>/api/v1, with a single-use localhost callback on a kernel-assigned port. No long-lived secret on disk — the access token expires within 15 minutes and only the refresh token persists.

SSH or no-display environments

When the CLI cannot open a browser (SSH session, container, headless server), use --no-browser. The CLI prints the auth URL; open it on a machine that has a browser, sign in, and the localhost callback resolves once consent is granted.

autousers login --no-browser

Print the auth URL instead of spawning a browser

API key (paste / CI / headless)

For CI pipelines, scripts, and Docker images, use a long-lived ak_live_* API key instead. Mint one at /settings/api-keys — keys are shown once, so paste it into a secrets manager immediately.

Option 1 — env var (recommended for CI)

export AUTOUSERS_API_KEY=ak_live_...
autousers eval list   # no `login` step needed

No login step required — env var alone authenticates

Option 2 — autousers login --key (workstation)

autousers login --key ak_live_...

Persists the key to ~/.autousers/config.json (mode 0600)

Resolution precedence

The CLI walks these in order on every command. First match wins.

1. --key flag on the command
2. AUTOUSERS_API_KEY environment variable
3. OAuth access token in ~/.autousers/config.json (auto-refreshed)
4. apiKey in ~/.autousers/config.json

Verify with whoami

autousers whoami

Prints the active user, team, and quota status

Sign out

autousers logout revokes the OAuth refresh token server-side (POST /oauth/revoke) and clears local credentials. ak_live_* API keys keep working until you delete them at /settings/api-keys.

autousers logout

Revoke + clear

Custom hosts (staging / self-hosted)

Override the API host with the AUTOUSERS_BASE_URL env var or --base-url flag. The default is https://app.autousers.ai. All requests go to <base-url>/api/v1/*.

AUTOUSERS_BASE_URL=http://localhost:3000 autousers login

Login against a local dev server