---
title: "Signing in"
description: "Create an account and write credentials from the terminal, and how the CLI decides which ones to use."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.minima.ltd/llms.txt
> Use this file to discover all available pages before exploring further.

# Signing in

The CLI signs itself in. You do not need the dashboard, and you do not need to
create an API key by hand first.

```sh
minima auth signup
```

It offers your `git config user.email` as the default, so most people press
Enter. A six-digit code arrives by email; paste it back and the terminal
finishes — no Enter needed, it submits on the sixth digit. You end up with an
account, an organization on the [free tier](/getting-started/free-tier), and
credentials written to disk.

`minima auth login` is the same command for a machine that already has an
account. Running `signup` twice signs you in, and says which happened.

Give the address directly when nothing should prompt:

```sh
minima auth signup --email you@example.com
```

## Why the email has no link

There is no link in the email, deliberately. A link that finished the sign-in
would be clicked by whoever owns the mailbox, while the credential goes to
whoever started the flow — so anyone could start one against your address, wait
for you to click, and be handed a key to your organization. Typing the code
into the terminal that asked for it is what keeps both halves in one pair of
hands.

It also means the email is inert. If you get one you did not ask for, ignore it.

A sign-in request lasts 10 minutes and accepts 5 wrong codes before it closes.
A wrong code leaves the request open — the CLI says so and keeps waiting. An
expired, spent or closed request stops the command instead, because another six
digits cannot fix it.

## What you get

The credential is an ordinary Admin API key, named after the machine that asked
for it, and it appears in Settings → API keys like any other. Signing in from a
second machine mints a second key, so revoking one does not log the other out.

```sh
minima auth status    # which credentials this machine will use
minima auth logout    # forget them locally
minima auth token     # print the key, for scripts
```

`logout` forgets the local copy. It does not revoke the key — do that in
Settings → API keys if the machine is not yours. `--all` forgets every stored
organization rather than the current one.

## Where credentials live

The config file is at `~/.config/minima/config.json`, mode `0600`
(`%APPDATA%\minima\config.json` on Windows). It holds one key per organization
and which one is the default, and the newest sign-in becomes the default.
`MINIMA_CONFIG_HOME` moves it, which is how you keep two accounts apart without
setting environment variables on every command.

Sign in to more than one organization and `--org` picks between them, by id or
by name:

```sh
minima --org "Afterimage Records" sites list
minima auth logout --org org_abc123
```

`--org` selects among what this machine has stored. It cannot point a key at an
organization the key does not belong to; the API refuses that regardless.

## Environment variables still win

```sh
export MINIMA_ORGANIZATION_ID=org_your_organization
export MINIMA_API_KEY=priv_your_api_key
```

Set both and they override anything `minima auth` stored, which is what CI
jobs, containers and agents should use — `minima auth token` prints a key
suitable for one:

```sh
export MINIMA_API_KEY=$(minima auth token)
```

Nothing signed in on a laptop can silently retarget a job configured this way.
For the same reason, `minima auth login` refuses to run when both variables are
set: it would mint a key the environment then hides.

Both identifiers are also available from the app: Settings → API keys, with the
organization ID at the top. A key created there must be type **Admin**, since
the CLI reads and writes — a [public key](/developers/api-keys) is not enough.

The CLI never writes credentials into your working directory. It does read a
`.env.local` or `.env` file from the directory you run it in, so a project can
keep its own settings there; real environment variables win over the file.
Anything holding `MINIMA_API_KEY` is a secret — add it to `.gitignore` and keep
it out of commits.

## Getting into the dashboard afterwards

An account created by `minima auth signup` has no password, so the sign-in form
has nothing you can fill in. Use **Email me a sign-in link** on the sign-in
page instead. The link opens a browser session and expires in 15 minutes.

That link is only ever a dashboard session. It never mints an API key, and it
cannot complete a terminal sign-in — those still need the request token held by
the terminal plus the code from your mailbox.

> **Caution**
>
> `minima auth` is rolling out and can be switched off per environment. If both
> `signup` and `login` answer with sign-in being unavailable, the flow is closed
> rather than broken — create an Admin key in Settings → API keys and set the two
> environment variables above.

Source: https://docs.minima.ltd/cli/auth/index.mdx