Authentication

Run polylane auth login and pick a method, or pass a flag to skip the picker:

polylane auth login                     # interactive picker
polylane auth login --no-browser        # device code, for SSH or headless machines
polylane auth login --api-key sk_xxxxx  # API key, for scripts and CI

OAuth (browser)

The recommended method for interactive use. The CLI opens your browser, runs an authorization code flow with proof key for code exchange, and receives the tokens on a localhost callback. Credentials persist to ~/.polylane/credentials.json with file mode 600. The CLI refreshes the access token automatically when it expires within five minutes. Force a refresh with polylane auth refresh.

With --no-browser the CLI prints a verification URL and a code instead. Open the URL on any device, enter the code, and the CLI polls until you approve.

After sign-in the CLI shows who you are and, if you belong to more than one workspace, prompts you to pick a default. The choice is saved as workspace_id in ~/.polylane/config.json.

API key

API keys are long-lived tokens that start with sk_. Create one in the console under Settings, API Keys: give it a name, toggle the permission scopes it needs, and copy the key. The key is shown once and cannot be viewed again.

Persist it locally:

polylane auth login --api-key sk_xxxxx

The CLI validates the key, selects a default workspace (prompting if you belong to more than one), and saves both to ~/.polylane/config.json.

For non-interactive use, skip the login step entirely:

export POLYLANE_API_KEY=sk_xxxxx
polylane issue list

Or pass the key on a single call with the global --api-key <key> flag.

Signup (bootstrap from an agent)

Coding agents that need to onboard without a browser can create an account directly:

polylane auth signup --email agent@example.com --password "$PW"

This creates the account, signs you in with a session token, and prints the next onboarding steps. The session expires; create an API key right after and switch to it for long-lived access.

Credential precedence

When several credentials are present, the CLI resolves them in this order:

1. --api-key flag on the current command
2. OAuth credentials in ~/.polylane/credentials.json
3. The POLYLANE_API_KEY environment variable
4. api_key in ~/.polylane/config.json

Check and switch

polylane auth status   # method in use, masked token, user, workspace
polylane auth whoami   # current user
polylane auth logout   # revoke OAuth tokens, clear stored credentials

auth logout asks for confirmation; pass --yes to skip it. To switch accounts, log out and log in with the other credential.

Environment variables

Use these in continuous integration jobs and containers where you don't want to write to ~/.polylane/. See Configuration for the full list and Scripting for CI patterns.