Signing in

The CLI signs itself in. You do not need the dashboard, and you do not need to create an API key by hand first.

minima auth signup

It offers your git config user.email as the default, so most people press Enter. A six-digit code arrives by email; paste it back and the terminal finishes — no Enter needed, it submits on the sixth digit. You end up with an account, an organization on the free tier, and credentials written to disk.

minima auth login is the same command for a machine that already has an account. Running signup twice signs you in, and says which happened.

Give the address directly when nothing should prompt:

minima auth signup --email you@example.com

Why the email has no link

There is no link in the email, deliberately. A link that finished the sign-in would be clicked by whoever owns the mailbox, while the credential goes to whoever started the flow — so anyone could start one against your address, wait for you to click, and be handed a key to your organization. Typing the code into the terminal that asked for it is what keeps both halves in one pair of hands.

It also means the email is inert. If you get one you did not ask for, ignore it.

A sign-in request lasts 10 minutes and accepts 5 wrong codes before it closes. A wrong code leaves the request open — the CLI says so and keeps waiting. An expired, spent or closed request stops the command instead, because another six digits cannot fix it.

What you get

The credential is an ordinary Admin API key, named after the machine that asked for it, and it appears in Settings → API keys like any other. Signing in from a second machine mints a second key, so revoking one does not log the other out.

minima auth status    # which credentials this machine will use
minima auth logout    # forget them locally
minima auth token     # print the key, for scripts

logout forgets the local copy. It does not revoke the key — do that in Settings → API keys if the machine is not yours. --all forgets every stored organization rather than the current one.

Where credentials live

The config file is at ~/.config/minima/config.json, mode 0600 (%APPDATA%\minima\config.json on Windows). It holds one key per organization and which one is the default, and the newest sign-in becomes the default. MINIMA_CONFIG_HOME moves it, which is how you keep two accounts apart without setting environment variables on every command.

Sign in to more than one organization and --org picks between them, by id or by name:

minima --org "Afterimage Records" sites list
minima auth logout --org org_abc123

--org selects among what this machine has stored. It cannot point a key at an organization the key does not belong to; the API refuses that regardless.

Environment variables still win

export MINIMA_ORGANIZATION_ID=org_your_organization
export MINIMA_API_KEY=priv_your_api_key

Set both and they override anything minima auth stored, which is what CI jobs, containers and agents should use — minima auth token prints a key suitable for one:

export MINIMA_API_KEY=$(minima auth token)

Nothing signed in on a laptop can silently retarget a job configured this way. For the same reason, minima auth login refuses to run when both variables are set: it would mint a key the environment then hides.

Both identifiers are also available from the app: Settings → API keys, with the organization ID at the top. A key created there must be type Admin, since the CLI reads and writes — a public key is not enough.

The CLI never writes credentials into your working directory. It does read a .env.local or .env file from the directory you run it in, so a project can keep its own settings there; real environment variables win over the file. Anything holding MINIMA_API_KEY is a secret — add it to .gitignore and keep it out of commits.

Getting into the dashboard afterwards

An account created by minima auth signup has no password, so the sign-in form has nothing you can fill in. Use Email me a sign-in link on the sign-in page instead. The link opens a browser session and expires in 15 minutes.

That link is only ever a dashboard session. It never mints an API key, and it cannot complete a terminal sign-in — those still need the request token held by the terminal plus the code from your mailbox.