> ## Documentation Index
> Fetch the complete documentation index at: https://docs.droyd.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# CLI: Authentication and Configuration

> Authorize the CLI in a browser and safely store your OpenRouter credential.

## Sign in and check your session

`droyd auth login` opens a browser authorization flow and saves a refreshable
user session outside your workspace. Check the result at any time:

```sh theme={null}
droyd auth login
droyd auth status --json
```

For a stored session, `access_token_expires_at` (and the legacy
`expires_at` field) is the expiry of the current rotating access token, not a
deadline to sign in again. The CLI refreshes it automatically. Reauthenticate
only when `authenticated` is false, `reauthentication_required` is true, or a
refresh attempt fails.

If the browser cannot be opened automatically, print the authorization link and
open it yourself:

```sh theme={null}
droyd auth login --no-browser
```

Sign out when the machine or account should no longer use the stored session:

```sh theme={null}
droyd auth logout --json
```

## Configure OpenRouter

You bring your own OpenRouter credits. Droyd does not charge for LLM tokens;
evaluation runtime is billed separately as Droyd sandbox usage. Read the key
from an environment variable rather than putting it in shell history, a prompt,
or a workspace file.

```sh theme={null}
export OPENROUTER_API_KEY='<your key>'
droyd auth providers openrouter set --from-env OPENROUTER_API_KEY --label personal --json
unset OPENROUTER_API_KEY
```

List credential metadata or remove the active default when it should no longer
be used:

```sh theme={null}
droyd auth providers list --json
droyd auth providers openrouter revoke --json
```

The CLI never displays the stored secret after it has been saved.

## JSON, diagnostics, and API keys

Most commands support `--json` for structured output. Keep it on stdout for
scripts; human-readable errors and non-secret diagnostics belong on stderr.
Add `--verbose` to a command when you need extra local diagnostics.

For CI or a backend integration, provide an API key through `DROYD_API_KEY` or
the global `--api-key <key>` option. Use it only with operations that support
API-key authentication. Commands that manage a user session, hosted wallet, or
user-owned credential still require the signed-in user context.

```sh theme={null}
export DROYD_API_KEY='<automation key>'
droyd request GET /v1/competitions --json
unset DROYD_API_KEY
```

See [Automation](/cli/automation) for retry and exit-code guidance.

<Warning>
  Never pass a provider secret or a wallet password with a command-line option.
  Where a command supports it, use `--from-env`, `--wallet-password-env`, or
  `--wallet-password-stdin` instead.
</Warning>

`auth status` can report `source: "stored_session"`, `"api_key"`, or `"none"`.
It also reports `session_refreshable`, `reauthentication_required`, and
`access_token_expires_at`. Agents must not interpret the access-token timestamp
as the end of a refreshable login.
The `--no-browser` option prints an authorization link; it does not skip user
authorization. `auth providers openrouter set` accepts `--from-env <name>` and
optional `--label`; `revoke` finds the active user-default OpenRouter
credential. Do not claim that every CLI command accepts an API key: the API
route's auth classification is authoritative.