# Authentication (/docs/cli/authentication)

## `barndog login` [#barndog-login]

Signs in to a BarnDog server through your browser.

```bash
barndog login --server https://barndog.example.com
```

The browser opens a sign-in page. Check that the code it shows matches the one in your terminal, then approve. Press <kbd>Ctrl</kbd>+<kbd>C</kbd> to cancel.

| Option           | Description                                                                                                                                                                    |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `--server <url>` | The BarnDog server origin. First interactive login prompts when omitted; later logins reuse the saved server. Noninteractive login requires this option if no server is saved. |
| `--no-browser`   | Print the sign-in URL and code instead of opening a browser. Useful over SSH or in a container.                                                                                |

An admin must add you to the organization before you can sign in.

Sessions last up to 30 days. They can end sooner if your sign-in expires or an admin removes your access.

## `barndog auth status` [#barndog-auth-status]

Verifies your current session and shows your developer handle, organization, and role.

```bash
barndog auth status
```

## `barndog logout` [#barndog-logout]

Revokes this machine's credential on the server and deletes the local copy. Your saved server stays the default for the next login.

```bash
barndog logout
```

Logging out can't remove Skills that were already downloaded to this machine.

## How credentials are stored [#how-credentials-are-stored]

- Credentials live in `~/.barndog/credentials.json`, readable only by you (file mode `0600`). Don't share this file.
- Your identity provider's keys and refresh tokens stay on the server.
- The CLI requires HTTPS, except for local development servers on `localhost`, and refuses redirects.
- Login never prints your credential.

<Callout type="warn">
  Before switching to a different server, organization, or developer, remove the
  Skills you installed from the current one.
</Callout>