# Log in

> Connect okibi to your account in the browser, over SSH, or with an API key for CI.

okibi stores one secret: your Okibi API key. Logging in creates that key for this machine.

## Log in

**Browser**

```sh
okibi auth login
```
Your browser opens, you approve the request, and the terminal continues on its own. No account yet? `okibi auth signup` runs the same flow and signs you up with GitHub.

**SSH or headless**

```sh
okibi auth login --device-code
```
okibi prints a code to enter on another device. Remote and headless sessions switch to this flow automatically.

**CI**

```sh
okibi auth login --api-key "$OKIBI_API_KEY"
```
Or skip the login and set `OKIBI_API_KEY` in the job's environment. See [Keys for CI](#keys-for-ci).

Check who you are logged in as:

```sh
okibi auth status
```

## Where the key is stored

The key goes into your OS keyring under the service `okibi-client`. When no keyring is available, such as on a headless Linux box or with `OKIBI_NO_KEYRING=1`, it is written to `~/.config/okibi/config.json` with owner-only permissions.

okibi picks the key in this order: `OKIBI_API_KEY`, then the keyring, then the config file. A key in `OKIBI_API_KEY` wins over your login, so check it first if okibi acts as the wrong account.

## Keys for CI

Create a key that is **locked to one workspace**, so a leaked CI secret can't touch your other workspaces:

```sh
okibi keys create --name github-actions --workspace acme
```

The key is printed once. Store it as a CI secret named `OKIBI_API_KEY`. Locked keys can't create workspaces, target another workspace, change membership, manage keys, or manage billing. See [API keys](https://okibi.ai/docs/guides/api-keys.md).

List and revoke keys:

```sh
okibi keys list
okibi keys revoke <key-id>
```

## Connect GitHub

Private repositories need the Okibi GitHub App on the account that owns them:

```sh
okibi auth github
```

Publishing a CLI's source into your own GitHub account uses a separate app with write access, connected with `okibi auth publisher`.

## Log out

```sh
okibi auth logout
```

This removes the key from this machine only. It does not unset `OKIBI_API_KEY` in your shell.