Skip to main content
Interactive command. Authenticates the Fjall CLI and stores credentials in ~/.fjall/auth.json.

​
Usage

fjall login authenticates the CLI against your Fjall account and stores credentials locally. There are two paths:
  • Device-code (default in interactive mode): a browser window confirms the login.
  • API key: paste a key from the dashboard, or pass --api-key.
There is no SSO or identity-provider integration.

​
Options

​
Authentication Flow

​
Interactive login

The command checks for saved credentials first. If none exist, it starts the browser device-code flow:
Open the URL (the verification code is pre-filled) and approve. To enter an API key instead, press e during this step. If you are already logged in, the command asks before overwriting (a Yes/No selector, defaulting to No):

​
Device-code login

Force the browser flow even when credentials exist:

​
API-key login

Skip the browser entirely by passing a key:
Generate API keys from the Fjall dashboard.

​
How It Works

  1. Checks for existing credentials at ~/.fjall/auth.json.
  2. Runs the browser device-code flow, or validates the supplied API key.
  3. Stores credentials locally with 0600 permissions.
  4. Confirms access to your Fjall account.

​
Credential Storage

Fjall writes credentials to your home directory:
These credentials:
  • Stay on your machine, never synced.
  • Authenticate API requests.
  • Carry restrictive file permissions (0600).
  • Can be removed at any time.

​
CI/CD Integration

Device-code login needs an interactive browser and does not work in CI. Use a CI deploy token instead — mint one in the web app under Settings → CI/CD Tokens (see CI/CD Integration): Environment variable (recommended)
The CLI reads FJALL_API_KEY before stored credentials, so no fjall login call is required. Non-interactive login
In non-interactive mode you must pass --api-key or --device; the command errors otherwise. --device still needs a human to open the printed URL and approve within 15 minutes (the poll times out otherwise), so unattended pipelines should use --api-key or FJALL_API_KEY.
fjall login --api-key accepts legacy fj_ user keys only — it stores the key as your credential. Scoped tokens (fjall_dk_ deploy tokens, fjall_ak_ agent tokens) are not stored by fjall login; pass them via FJALL_API_KEY instead, which every command reads directly. For pipelines prefer a deploy token; for AI agents acting as you, use an agent token from fjall token create.

​
Security

  • Keep the ~/.fjall/ directory private.
  • Generate a separate API key for each environment.
  • Rotate keys on a regular schedule.

​
Removing Credentials

​
Troubleshooting

​
Authentication failed

Common causes and fixes:

​
Not authenticated

If commands report you are not authenticated:
  • Run fjall login again.
  • Confirm ~/.fjall/auth.json exists.
  • Verify the file is readable (0600 for your user).

​
Shared machines

Each OS user has separate credentials under their own home directory, so there are no conflicts between users.

​
Next Steps

Create an application

Scaffold an app and its infrastructure.

Connect AWS

Link an AWS account before deploying.

Deploy

Push your application to AWS.

List resources

Inspect resources in an application’s infrastructure.
Login is optional for local-only work. It is required for any command that talks to Fjall’s cloud services.