> ## Documentation Index
> Fetch the complete documentation index at: https://docs.royaltyport.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate the Royaltyport CLI via browser login or API token.

The CLI supports two authentication methods. **Browser login** (default) opens your browser for a secure OAuth sign-in. **API tokens** are available for headless environments like CI/CD pipelines.

## Browser Login (Default)

```bash theme={null}
royaltyport login
```

This opens your browser where you sign in to Royaltyport and approve access. The CLI receives tokens automatically and stores them locally. No token to copy or paste.

Tokens are refreshed automatically — you stay logged in until you explicitly log out.

***

## API Token Login

For CI/CD, automation, or environments without a browser, pass an API token directly:

```bash theme={null}
royaltyport login --token rp_your_token_here
```

Tokens are created in **Organizations > Settings > Tokens**. See [Authentication](/api-reference/authentication#api-tokens) for details.

| Option            | Short | Description                     |
| ----------------- | ----- | ------------------------------- |
| `--token <token>` | `-t`  | API token (skips browser login) |

## Piped / Non-Interactive Login

When stdin is not a terminal (e.g., inside a Docker container or piped from another command), the CLI cannot open a browser. It will prompt for an API token via stdin instead:

```bash theme={null}
echo "rp_your_token_here" | royaltyport login
```

This is useful in containerized environments or scripts where neither `--token` nor environment variables are practical.

## Custom API URL

Point the CLI at a different API endpoint:

```bash theme={null}
royaltyport login --api-url https://your-api-url.com
```

| Option            | Description                                                  |
| ----------------- | ------------------------------------------------------------ |
| `--api-url <url>` | Custom API base URL (default: `https://api.royaltyport.com`) |

***

## Environment Variables

For CI/CD pipelines and automation, set environment variables instead of running `login`:

| Variable              | Description                                                  |
| --------------------- | ------------------------------------------------------------ |
| `ROYALTYPORT_TOKEN`   | API token — overrides stored credentials                     |
| `ROYALTYPORT_API_URL` | Custom API base URL (default: `https://api.royaltyport.com`) |

Environment variables always take priority over stored configuration.

### Example

```bash theme={null}
export ROYALTYPORT_TOKEN=rp_your_token_here
royaltyport projects
```

***

## Auth Resolution Order

The CLI resolves credentials in this order:

1. `ROYALTYPORT_TOKEN` environment variable (highest priority)
2. OAuth access token (from browser login, auto-refreshed)
3. Stored API token in `~/.config/royaltyport/config.json`

The API URL is resolved similarly:

1. `ROYALTYPORT_API_URL` environment variable
2. Stored `apiUrl` in config
3. Default: `https://api.royaltyport.com`

***

## Logout

Clear all stored credentials and configuration:

```bash theme={null}
royaltyport logout
```

This removes the config file at `~/.config/royaltyport/config.json`. Environment variables are not affected.