> ## Documentation Index
> Fetch the complete documentation index at: https://ifdocdemo.lumivescence.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate

> Log an agent in with the OAuth device flow or with an API key, in the sandbox or in production.

One login connects the agent to discovery, enrollment, and payments. By default, the agent pays from the InFlow balance of this account.

| Method | How it works | Use it when |
| - | - | - |
| Device flow | The owner approves the login in a browser. The CLI stores the tokens in the vault. | A person owns the agent and approves its payments. |
| API key | The CLI sends the key on every request, with no browser step. | The agent runs on a server or in CI, with a key from a dashboard. |

Unlock the [vault](/agents/install-the-cli#unlock-the-vault) before you log in.

## Check the current state

Check whether the agent already has a session.

```bash theme={null}
inflow auth status
```

If `authenticated` is `false`, log in. Add `--probe` to test the stored access token against the server. The probe calls `GET /v1/users/self`.

```bash theme={null}
inflow auth status --probe
```

## Log in with the device flow

```bash theme={null}
inflow auth login --client-name "my-agent"
```

Choose a clear and unique name for `--client-name`. The owner sees this name on the approval page. The default name is `InFlow`.

The response contains three values.

| Field | What to do with it |
| - | - |
| `verification_url` | Give this URL to the owner. The owner opens it and approves the login. |
| `phrase` | Give this phrase to the owner with the URL. |
| `_next.command` | Run this command at once. Do not wait for the owner to reply. It polls until the login completes. |

### Poll in the same command

Set a positive `--interval` to poll until the device flow ends.

```bash theme={null}
inflow auth login --client-name "my-agent" --interval 5 --timeout 300
```

Use this form when your environment cannot show the phrase while another command blocks the terminal.

| Flag | Default | What it does |
| - | - | - |
| `--interval` | `0` | Poll cadence in seconds. `0` returns the verification URL and a follow-up command at once. |
| `--max-attempts` | `0` | The maximum number of polls. `0` sets no limit, but `--timeout` still applies. |
| `--timeout` | `300` | The polling deadline in seconds. |

Then run `inflow auth status` to confirm the login.

## Log in with an API key

Pass `--api-key`, or set `INFLOW_API_KEY`. The CLI then sends the key as `X-API-KEY` on every request.

```bash theme={null}
export INFLOW_API_KEY=your_key_here
inflow balances list
```

When both are present, the flag wins for that command.

For an agent that only buys, InFlow recommends an API key from a **Developer account**. A seller integration needs a key from a **Seller account**. See [Create a Seller account](/sellers/create-a-seller-account).

<Warning>
  Treat API keys and OAuth tokens as secrets. Never print them in chat, in logs, or in a plan file.
</Warning>

## Choose an environment

The CLI uses `production` by default. Select the sandbox in one of three ways.

| Method | Example |
| - | - |
| The `--sandbox` flag | `inflow auth status --sandbox` |
| The `--environment` flag | `inflow auth status --environment sandbox` |
| The `INFLOW_ENVIRONMENT` variable | `export INFLOW_ENVIRONMENT=sandbox` |

Tokens stay in the environment that issued them. Log in one time for each environment that you use.

```bash theme={null}
inflow auth login --sandbox --client-name "my-agent" --interval 5
inflow auth status --sandbox
```

The CLI reads its settings in this order: the CLI flag, the environment variable, the saved configuration, and the built-in default.

## Log out

```bash theme={null}
inflow auth logout
```

<Warning>
  `inflow auth logout` also deletes the local vault and the stored service credentials. Get approval from the owner before an agent runs it.
</Warning>

## Troubleshooting

<AccordionGroup>
  <Accordion title="The login never completes">
    The owner did not approve the login before the deadline. The default deadline is 300 seconds. Run `inflow auth login` again. Give the new URL to the owner at once.
  </Accordion>

  <Accordion title="auth status reports authenticated, but requests fail">
    Run `inflow auth status --probe`. The probe tests the token against the server. If the probe fails, log in again.
  </Accordion>

  <Accordion title="The login works in one environment but not in the other">
    Tokens do not move between environments. Log in again with `--sandbox`, or without it for production.
  </Accordion>
</AccordionGroup>

For the vault and `403 SELLER_ACCOUNT_REQUIRED` errors, see [Errors](/reference/errors).

## Next step

<Card title="Discover and enroll" icon="compass" href="/agents/discover-and-enroll">
  Find a service in the directory and get a credential for it.
</Card>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.