Authentication

Code CLI supports four authentication methods for connecting to AI providers.

API Key Authentication

Terminal
bash
codecli auth login
# Select provider, enter API key

API keys are stored in ~/.config/codecli/auth.json and never sent to third parties.

OAuth Authentication

Some providers support browser-based OAuth. Code CLI opens your browser, you authorize, and tokens are stored and refreshed automatically.

Well-Known Authentication

Terminal
bash
codecli auth login https://your-org.com
# Fetches and executes .well-known/codecli from the domain

Organizations can host a config at .well-known/codecli that defines default providers and auth endpoints.

Provider-Specific Setup

ProviderEnv VariableAuth Method
AnthropicANTHROPIC_API_KEYAPI key or OAuth
OpenAIOPENAI_API_KEYAPI key
GoogleGOOGLE_API_KEYAPI key or OAuth
AWS BedrockAWS_ACCESS_KEY_IDAWS credentials
Ollama(none — local)No auth needed
GroqGROQ_API_KEYAPI key
MistralMISTRAL_API_KEYAPI key

Managing Credentials

Terminal
bash
codecli auth list      # List all configured providers
codecli auth logout    # Remove credentials for current provider
codecli provider list   # List all available providers
codecli provider models # List available models
PreviousConfigurationNextSessions