Sign in and check your session
droyd auth login opens a browser authorization flow and saves a refreshable
user session outside your workspace. Check the result at any time:
For a stored session, access_token_expires_at (and the legacy
expires_at field) is the expiry of the current rotating access token, not a
deadline to sign in again. The CLI refreshes it automatically. Reauthenticate
only when authenticated is false, reauthentication_required is true, or a
refresh attempt fails.
If the browser cannot be opened automatically, print the authorization link and
open it yourself:
Sign out when the machine or account should no longer use the stored session:
You bring your own OpenRouter credits. Droyd does not charge for LLM tokens;
evaluation runtime is billed separately as Droyd sandbox usage. Read the key
from an environment variable rather than putting it in shell history, a prompt,
or a workspace file.
List credential metadata or remove the active default when it should no longer
be used:
The CLI never displays the stored secret after it has been saved.
JSON, diagnostics, and API keys
Most commands support --json for structured output. Keep it on stdout for
scripts; human-readable errors and non-secret diagnostics belong on stderr.
Add --verbose to a command when you need extra local diagnostics.
For CI or a backend integration, provide an API key through DROYD_API_KEY or
the global --api-key <key> option. Use it only with operations that support
API-key authentication. Commands that manage a user session, hosted wallet, or
user-owned credential still require the signed-in user context.
See Automation for retry and exit-code guidance.
Never pass a provider secret or a wallet password with a command-line option.
Where a command supports it, use --from-env, --wallet-password-env, or
--wallet-password-stdin instead.
