Skip to content
Layer Docs

CLI authentication

Sign in

Section titled “Sign in”
Terminal window
layer login

The CLI prints a link and a short code, and opens the link in your browser when the machine has one. Check that the page shows the same code, then sign in with your Layer account, the same way you sign in on the web: your company’s single sign-on included. The terminal picks up the session once you have, and stores the credential in your operating system keychain. The profile is pinned to the deployment you signed in to, so a later command cannot silently talk to a different one.

Over SSH, inside a container, or on any machine that cannot open a browser, open the link on another device: the code ties that sign-in to this terminal.

Sign in with a token

Section titled “Sign in with a token”
Terminal window
layer login --token pat_...

Useful when you want the token stored like a browser sign-in. For a run that must not touch stored credentials at all (CI, a render farm, a scheduled job), set the environment variable instead:

Terminal window
export LAYER_API_KEY=pat_...
layer generate image -p "..."

LAYER_API_KEY wins over anything stored, so a CI job never picks up a developer’s session. Create a token from Settings → Personal Access Tokens in the app; see authentication for the permission model.

Check and change who you are

Section titled “Check and change who you are”
Terminal window
layer whoami            # the account, workspace, and deployment in use
layer use my-studio     # choose the workspace subsequent commands act on
layer logout            # sign out and forget the stored credential

layer use takes a workspace name, slug, or id, and writes the choice to the active profile. To pin a directory rather than your whole shell, commit a layer.toml.