# CLI authentication

## Sign in

```bash
layer login
```

The CLI prints a link and a short code, and opens the link in your browser when the machine has one. Check that the page shows the same code, then sign in with your Layer account, the same way you sign in on the web: your company’s single sign-on included. The terminal picks up the session once you have, and stores the credential in your operating system keychain. The profile is pinned to the deployment you signed in to, so a later command cannot silently talk to a different one.

Over SSH, inside a container, or on any machine that cannot open a browser, open the link on another device: the code ties that sign-in to this terminal.

## Sign in with a token

```bash
layer login --token pat_...
```

Useful when you want the token stored like a browser sign-in. For a run that must not touch stored credentials at all (CI, a render farm, a scheduled job), set the environment variable instead:

```bash
export LAYER_API_KEY=pat_...
layer generate image -p "..."
```

`LAYER_API_KEY` wins over anything stored, so a CI job never picks up a developer’s session. Create a token from **Settings → Personal Access Tokens** in the app; see [authentication](/docs/authentication) for the permission model.

## Check and change who you are

```bash
layer whoami            # the account, workspace, and deployment in use
layer use my-studio     # choose the workspace subsequent commands act on
layer logout            # sign out and forget the stored credential
```

`layer use` takes a workspace name, slug, or id, and writes the choice to the active profile. To pin a directory rather than your whole shell, commit a [layer.toml](/docs/cli/configuration).

Caution

Exit code `3` means authentication: not signed in, the credential expired, or the token lacks access to what you asked for. A script can branch on it without parsing the message. See [scripting](/docs/cli/scripting).