Skip to main content
Sign in to any supported provider with a single command. OAuth tokens refresh automatically, so you never have to re-paste an API key.
The user runs praisonai auth login; OAuth tokens are stored and refreshed so agents call the provider without pasting API keys.

​
Quick Start

1

Log in with browser (recommended)

GitHub uses the device-code flow (no local browser callback listener): a short code prints, a browser tab opens to the verification page, and credentials are stored once you approve.
2

Log in on a headless server (device code)

On a machine without a browser, add --no-browser to get a device code:
Enter the code on any device, then come back — the CLI detects approval automatically.
3

Force API-key login

If you prefer to manage keys manually, use --method apikey:
You’ll be prompted for the key interactively (hidden input), or pipe it:
4

Check auth status and expiry

Shows whether the current token is valid and when it expires.

​
How It Works

​
Auth Methods

​
Provider Compatibility

Use praisonai auth login <provider> --method auto — the CLI auto-detects whether OAuth is supported. Registry providers need a --client-id; without one, auto prints how to switch to OAuth and falls back to the API-key prompt.

​
Token Storage

Credentials are stored at ~/.praisonai/credentials.json (or the path returned by praisonai paths). Legacy ~/.praison/credentials.json is read as a fallback and migrated on the next write — no re-login required. Each provider gets its own entry containing:
  • Auth method (apikey or oauth)
  • Token value (API key or access token)
  • Refresh token (OAuth only)
  • Expiry timestamp (OAuth only)
Tokens are refreshed transparently before each agent run when they are within the refresh window.

​
Best Practices

OAuth device-code flows require human interaction. In automated pipelines (CI/CD, cron jobs), always use API keys via environment variables:
Or store them with --method apikey and a --key-stdin pipe from your secrets manager.
When you rotate an API key or revoke an OAuth token:
This removes the old credential and re-runs the login flow.
OAuth credentials are provider-scoped. If a provider has multiple models, pin the default model at login time:
Registry providers ship endpoints but no client_id. Register your OAuth app with the provider (GitHub App / Google OAuth client for TVs / Azure AD app), then pass its id with --client-id. Until a first-party PraisonAI app is provisioned, you use your own.
For a provider outside the registry, supply the OAuth endpoints directly with CLI flags:

Security Environment Variables

How to pass credentials safely via environment variables

Default Model Selection

How the CLI picks the right model when multiple providers are logged in

MCP OAuth

MCP tools have their own OAuth flow, separate from CLI provider sign-in