Authentication | Astro AI

Authentication links the CLI and API to your Astro AI account. You need it to push agents to the registry, access private deployments, and call protected endpoints. Sign in with ast login (an account is required). If you don’t have one, sign up.

Log in

Start the device flow

Run ast login. The CLI shows a short code (e.g. ABCD-EFGH) and a verification URL.

Enter the code

Open the URL, enter the code, and sign in.

Let the CLI finish

The CLI polls until authentication completes, then stores the tokens.

Verify

Run ast whoami; you should see your user and active account.

Tokens are stored in the system keyring when available (macOS Keychain, Linux Secret Service, Windows Credential Manager). Otherwise they are stored in ~/.ast/credentials.json with restricted permissions.

CLI commands

Command	Description
`ast login`	Start device flow and open browser to authenticate; re-login restores your last active account
`ast login --no-browser`	Print the verification URL instead of opening it
`ast login --account <name>`	Switch to the named account after login; overrides the account restored from your previous session
`ast logout`	Clear stored credentials for the current profile
`ast logout --all`	Clear all stored credentials
`ast whoami`	Show current user and account info

Token lifecycle

Access token: Short-lived (~1 hour), used for API requests.
Refresh token: Long-lived; used to obtain new access tokens.

The CLI refreshes the access token automatically when it is close to expiry.

Next steps

After logging in you can switch between accounts. See Working with accounts.