Skip to main content

​
aether auth

Manage CLI authentication. Logging in mints a platform API key named cli-<hostname> and stores it in ~/.aether/config.json. The key does not expire and nothing about it rotates — it is valid until revoked. You can also authenticate non-interactively with the AETHER_TOKEN environment variable.
Revoking cli-<hostname> under Settings → API keys logs that machine out. This is the same key type aether token manages, so a CLI login shows up in that list alongside your other keys.

​
Usage

​
Subcommands

​
aether auth login

Authenticate with the Aether API. The CLI opens the web login in your browser — sign in there with any method (Google, GitHub, Apple, or an emailed code) and the browser hands the session back. Without a TTY it prints the login URL and waits for the localhost callback. Every interactive path ends the same way: the CLI signs you in, exchanges that sign-in for a platform API key named cli-<hostname>, and stores the key. The sign-in session itself is used for that one exchange and then discarded. Logging in again mints the replacement first and only then retires the key this installation already held, so an interrupted login never leaves the machine without a working credential. The key being retired is the exact one recorded at the last login — never one matched by name, since two machines can share a hostname and a name match would revoke the other machine’s key. A consequence: if you delete ~/.aether/config.json and log in again, the CLI no longer knows about the old key, so it stays valid until you revoke it under Settings → API keys. Retirement presents the old key rather than your new sign-in, so it works even when you log in as a different account on the same machine — the previous account’s key is retired instead of being left live and forgotten.
--token stores the value exactly as given and mints nothing, so CI never grows a permanent key as a side effect of logging in. Pass either a platform API key or a JWT; an expired JWT surfaces later as a 401 telling you to log in again. If the machine is already logged in with a key the CLI minted, --token refuses rather than overwriting it: dropping the stored key id would leave that key valid with nothing able to revoke it. Run aether auth logout first. Browser login is supported in a non-TTY shell for coding agents: the command prints the URL before it waits, so the agent can give the URL to its human. The human completes the browser page while the command remains running. --token remains the explicit CI/script path.

​
aether auth logout

Revoke this machine’s API key and clear the stored credentials.
Logout only clears the local credential once the key is confirmed gone. If the revoke cannot be confirmed — you are offline, or the API is down — the credential is kept and the command exits nonzero, so you can simply run logout again later. Discarding it would leave a key that is probably still live with nothing able to revoke it. To log out immediately regardless, revoke the key under Settings → API keys (find it by the prefix the command prints) and run logout again. A key that was already revoked in Settings → API keys is not an error; logout just clears the local config. If the config is damaged to the point that the credential cannot be read, logout still clears it and tells you which key id was named, so you can revoke it manually. A --token login owns no server-side key, so logout only clears the local config.

​
aether auth status

Show the current authentication state, the key in use, default project, and API URL. There is no expiry to report; the stored key is valid until revoked. status checks the stored credential or AETHER_TOKEN against the API, so an invalid or revoked key reads as logged out here rather than appearing to work until the next command fails.
When authenticated via the environment variable:
When not authenticated:

​
aether auth token

Print the stored credential to stdout. Useful for piping into other tools. The credential does not expire, so this is safe to call from scripts at any time.