> For the complete documentation index, see [llms.txt](/llms.txt).
> A full single-fetch corpus is available at [llms-full.txt](/llms-full.txt).
---
last_verified: 2026-05-13
title: Authentication Commands
category: CLI
description: Authentication and identity management for AGNT5 CLI
---

Authentication is required before you can create projects, deploy, or interact with the Control Plane. Credentials are stored in `~/.agnt5/config.yaml` and read on every invocation.


**Commands**: `agnt5 auth login [--api-key <value>]`, `agnt5 auth logout`, `agnt5 auth whoami`
**Credential store**: `~/.agnt5/config.yaml` (persisted on login, read on every invocation)
**Env overrides**: `AGNT5_API_KEY` bypasses the login command; `AGNT5_API_URL` overrides the Control Plane URL
**Auth flow**: browser-based OAuth via PropelAuth; CLI polls the Control Plane until an API key is issued


### `agnt5 auth login`

<CommandLayout command="auth login">
  <div slot="documentation">
    Launches the authentication flow. By default the CLI requests a short-lived session ID from the Control Plane, opens your browser to the PropelAuth login screen, and polls until an API key is issued. The generated key is persisted to `~/.agnt5/config.yaml` so subsequent commands can reuse it.

    ### Syntax
    ```bash
    agnt5 auth login [options]
    ```

    ### Options

    | Flag | Description |
    | --- | --- |
    | `--api-key <value>` | Skip the browser flow and provide an existing API key. The CLI validates the key by fetching the current user before saving it locally. |

    <Callout type="info">
    The CLI respects `AGNT5_API_URL` and other context settings when constructing the OAuth URLs, so ensure your context is correct before logging in. You can also provide `AGNT5_API_KEY` in the environment to bypass the login command entirely.
    </Callout>
  </div>

  <div slot="examples">
    <Tabs defaultValue="oauth">
      <TabsList>
        <TabsTrigger value="oauth">OAuth flow</TabsTrigger>
        <TabsTrigger value="apikey">With API key</TabsTrigger>
        <TabsTrigger value="success">Success response</TabsTrigger>
      </TabsList>

      <TabsContent value="oauth">
        <ExampleBlock title="Command" variant="command">
          ```bash
          agnt5 auth login
          ```
        </ExampleBlock>

        <ExampleBlock title="Response" variant="response">
          ```
          Starting authentication flow...
          ✓ Session ID requested from Control Plane

          Opening browser for authentication...
          → https://auth.agnt5.com/propelauth/login

          Waiting for authentication to complete...
          ✓ Authentication successful
          ✓ API key saved to ~/.agnt5/config.yaml

          You are now authenticated as: user@example.com
          ```
        </ExampleBlock>
      </TabsContent>

      <TabsContent value="apikey">
        <ExampleBlock title="Command" variant="command">
          ```bash
          agnt5 auth login --api-key agnt5_sk_abc123...
          ```
        </ExampleBlock>

        <ExampleBlock title="Response" variant="response">
          ```
          Validating provided API key...
          ✓ API key is valid
          ✓ User verified: user@example.com
          ✓ API key saved to ~/.agnt5/config.yaml

          Authentication complete.
          ```
        </ExampleBlock>
      </TabsContent>

      <TabsContent value="success">
        <ExampleBlock title="Command" variant="command">
          ```bash
          agnt5 auth login
          ```
        </ExampleBlock>

        <ExampleBlock title="Response" variant="response">
          ```
          ✓ Already authenticated as: user@example.com
          ✓ API key is valid and active

          Current context: production
          API URL: https://api.agnt5.com

          No action needed.
          ```
        </ExampleBlock>
      </TabsContent>
    </Tabs>
  </div>
</CommandLayout>

### `agnt5 auth logout`

<CommandLayout command="auth logout">
  <div slot="documentation">
    Clears any stored API keys and tokens from `~/.agnt5/config.yaml`. You can re-authenticate later with `agnt5 auth login`.

    ### Syntax
    ```bash
    agnt5 auth logout
    ```
  </div>

  <div slot="examples">
    <Tabs defaultValue="basic">
      <TabsList>
        <TabsTrigger value="basic">Logout</TabsTrigger>
        <TabsTrigger value="already">Already logged out</TabsTrigger>
      </TabsList>

      <TabsContent value="basic">
        <ExampleBlock title="Command" variant="command">
          ```bash
          agnt5 auth logout
          ```
        </ExampleBlock>

        <ExampleBlock title="Response" variant="response">
          ```
          ✓ API key cleared from ~/.agnt5/config.yaml
          ✓ Authentication tokens removed

          You have been logged out successfully.
          Use 'agnt5 auth login' to authenticate again.
          ```
        </ExampleBlock>
      </TabsContent>

      <TabsContent value="already">
        <ExampleBlock title="Command" variant="command">
          ```bash
          agnt5 auth logout
          ```
        </ExampleBlock>

        <ExampleBlock title="Response" variant="response">
          ```
          No authentication credentials found.
          Already logged out.
          ```
        </ExampleBlock>
      </TabsContent>
    </Tabs>
  </div>
</CommandLayout>

### `agnt5 auth status`

<CommandLayout command="auth status">
  <div slot="documentation">
    Displays whether you are authenticated, printing the email associated with the stored key along with the active environment and API base URL. If the saved key is invalid the command reports the failure and suggests `agnt5 auth login`.

    ### Syntax
    ```bash
    agnt5 auth status
    ```
  </div>

  <div slot="examples">
    <Tabs defaultValue="authenticated">
      <TabsList>
        <TabsTrigger value="authenticated">Authenticated</TabsTrigger>
        <TabsTrigger value="invalid">Invalid key</TabsTrigger>
        <TabsTrigger value="notauth">Not authenticated</TabsTrigger>
      </TabsList>

      <TabsContent value="authenticated">
        <ExampleBlock title="Command" variant="command">
          ```bash
          agnt5 auth status
          ```
        </ExampleBlock>

        <ExampleBlock title="Response" variant="response">
          ```
          ✓ Authenticated as: user@example.com
          ✓ API key is valid

          Environment: production
          API URL: https://api.agnt5.com
          Context: production

          Authentication status: Active
          ```
        </ExampleBlock>
      </TabsContent>

      <TabsContent value="invalid">
        <ExampleBlock title="Command" variant="command">
          ```bash
          agnt5 auth status
          ```
        </ExampleBlock>

        <ExampleBlock title="Response" variant="response">
          ```
          ✗ Authentication failed
          ✗ Stored API key is invalid or expired

          Please run 'agnt5 auth login' to re-authenticate.
          ```
        </ExampleBlock>
      </TabsContent>

      <TabsContent value="notauth">
        <ExampleBlock title="Command" variant="command">
          ```bash
          agnt5 auth status
          ```
        </ExampleBlock>

        <ExampleBlock title="Response" variant="response">
          ```
          ✗ Not authenticated

          No API key found in ~/.agnt5/config.yaml
          Run 'agnt5 auth login' to authenticate.
          ```
        </ExampleBlock>
      </TabsContent>
    </Tabs>
  </div>
</CommandLayout>

### `agnt5 whoami`

<CommandLayout command="whoami">
  <div slot="documentation">
    Prints the email address tied to the stored credentials. This command is also available via `agnt5 auth whoami` and returns `Not authenticated` when no valid key is present.

    ### Syntax
    ```bash
    agnt5 whoami
    ```
  </div>

  <div slot="examples">
    <Tabs defaultValue="authenticated">
      <TabsList>
        <TabsTrigger value="authenticated">Authenticated</TabsTrigger>
        <TabsTrigger value="notauth">Not authenticated</TabsTrigger>
      </TabsList>

      <TabsContent value="authenticated">
        <ExampleBlock title="Command" variant="command">
          ```bash
          agnt5 whoami
          ```
        </ExampleBlock>

        <ExampleBlock title="Response" variant="response">
          ```
          user@example.com
          ```
        </ExampleBlock>
      </TabsContent>

      <TabsContent value="notauth">
        <ExampleBlock title="Command" variant="command">
          ```bash
          agnt5 whoami
          ```
        </ExampleBlock>

        <ExampleBlock title="Response" variant="response">
          ```
          Not authenticated
          ```
        </ExampleBlock>
      </TabsContent>
    </Tabs>
  </div>
</CommandLayout>

### `agnt5 version`

<CommandLayout command="version">
  <div slot="documentation">
    Display CLI build metadata including version string, Go runtime, and platform. Use this command to inspect the CLI build information.

    ### Syntax
    ```bash
    agnt5 version
    ```

    <Callout type="info">
    Use `agnt5 version` paired with `agnt5 whoami` to confirm both your binary and credentials before deploying.
    </Callout>
  </div>

  <div slot="examples">
    <Tabs defaultValue="version">
      <TabsList>
        <TabsTrigger value="version">Version info</TabsTrigger>
        <TabsTrigger value="combined">With whoami</TabsTrigger>
      </TabsList>

      <TabsContent value="version">
        <ExampleBlock title="Command" variant="command">
          ```bash
          agnt5 version
          ```
        </ExampleBlock>

        <ExampleBlock title="Response" variant="response">
          ```
          AGNT5 CLI v1.2.3

          Build Information:
            Version: 1.2.3
            Go version: go1.21.0
            Platform: darwin/amd64
            Build date: 2024-01-15 10:30:45
            Git commit: abc1234
          ```
        </ExampleBlock>
      </TabsContent>

      <TabsContent value="combined">
        <ExampleBlock title="Command" variant="command">
          ```bash
          agnt5 version && agnt5 whoami
          ```
        </ExampleBlock>

        <ExampleBlock title="Response" variant="response">
          ```
          AGNT5 CLI v1.2.3

          Build Information:
            Version: 1.2.3
            Go version: go1.21.0
            Platform: darwin/amd64
            Build date: 2024-01-15 10:30:45
            Git commit: abc1234

          user@example.com
          ```
        </ExampleBlock>
      </TabsContent>
    </Tabs>
  </div>
</CommandLayout>
