# Managing Authentication
Source: https://docs.chain.link/cre/account/managing-auth
Last Updated: 2026-03-26


This guide covers how to manage your CLI authentication, including browser-based login, API key authentication, checking your status, handling session expiration, and logging out.

## Logging in

To authenticate your CLI with your CRE account, use the `cre login` command. This opens a browser window where you'll enter your credentials and complete two-factor authentication.

For detailed login instructions, see the [Logging in with the CLI](/cre/account/cli-login) guide.

Browser login stores **`~/.cre/cre.yaml`** (credentials) and **`~/.cre/context.yaml`** (cached **tenant context**: registry manifest from the platform, including vault gateway URL and related settings). **`cre logout`** removes both. For a full description and a sample `context.yaml` shape, see [Tenant context cache](/cre/reference/cli/authentication#tenant-context-cache).

## API key authentication

> **NOTE: Deploy access required**
>
> API key authentication requires your account to have Early Access approval for deployment. To <a href="https://app.chain.link/cre/request-access" target="_blank" rel="noopener noreferrer">request Early Access</a>, please share details about your project and use case—this helps us provide better support as you build with CRE.

For CI/CD pipelines or headless environments where a browser is not available, you can authenticate using the `CRE_API_KEY` environment variable. When set, the CLI uses the API key automatically — no `cre login` required.

```bash
export CRE_API_KEY="your-api-key"
cre whoami
```

API keys are created in the **APIs** tab of the **Organization** page in the <a href="https://app.chain.link/cre/discover" target="_blank" rel="noopener noreferrer">CRE platform</a>. For full details, see [API Key Authentication](/cre/reference/cli/authentication#api-key-authentication).

## Session expiration

Your CLI session remains authenticated until you explicitly log out or until your session expires. When your session expires, you'll need to log in again.

If you attempt to run a command with an expired session, you'll see an error:

```bash
Error: failed to attach credentials: failed to load credentials: you are not logged in, try running cre login
```

To resolve this, simply run `cre login` again to re-authenticate.

## Checking authentication status

To verify that you're logged in and view your account details, use the `cre whoami` command:

```bash
cre whoami
```

This command displays your account information:

```bash
Account details retrieved:

Email:           email@domain.com
Organization ID: org_mEMRknbVURM9DWsB
Deploy Access:   Not enabled (run 'cre account access' to request)
```

If you're not logged in, you'll receive an error message prompting you to run `cre login`.

To check your deploy access status or submit a request, see [Requesting Deploy Access](/cre/account/deploy-access).

## Logging out

To explicitly end your CLI session and remove your stored credentials **and cached tenant context** (`context.yaml`), use the `cre logout` command:

```bash
cre logout
```

After logging out, you'll need to run `cre login` again to authenticate future CLI commands.