Skip to main content
One login connects the agent to discovery, enrollment, and payments. By default, the agent pays from the InFlow balance of this account. Unlock the vault before you log in.

​
Check the current state

Check whether the agent already has a session.
If authenticated is false, log in. Add --probe to test the stored access token against the server. The probe calls GET /v1/users/self.

​
Log in with the device flow

Choose a clear and unique name for --client-name. The owner sees this name on the approval page. The default name is InFlow. The response contains three values.

​
Poll in the same command

Set a positive --interval to poll until the device flow ends.
Use this form when your environment cannot show the phrase while another command blocks the terminal. Then run inflow auth status to confirm the login.

​
Log in with an API key

Pass --api-key, or set INFLOW_API_KEY. The CLI then sends the key as X-API-KEY on every request.
When both are present, the flag wins for that command. For an agent that only buys, InFlow recommends an API key from a Developer account. A seller integration needs a key from a Seller account. See Create a Seller account.
Treat API keys and OAuth tokens as secrets. Never print them in chat, in logs, or in a plan file.

​
Choose an environment

The CLI uses production by default. Select the sandbox in one of three ways. Tokens stay in the environment that issued them. Log in one time for each environment that you use.
The CLI reads its settings in this order: the CLI flag, the environment variable, the saved configuration, and the built-in default.

​
Log out

inflow auth logout also deletes the local vault and the stored service credentials. Get approval from the owner before an agent runs it.

​
Troubleshooting

The owner did not approve the login before the deadline. The default deadline is 300 seconds. Run inflow auth login again. Give the new URL to the owner at once.
Run inflow auth status --probe. The probe tests the token against the server. If the probe fails, log in again.
Tokens do not move between environments. Log in again with --sandbox, or without it for production.
For the vault and 403 SELLER_ACCOUNT_REQUIRED errors, see Errors.

​
Next step

Discover and enroll

Find a service in the directory and get a credential for it.
Last modified on October 15, 2026