Grida CLI authentication
Grida login is for account services and Grida Gateway (GG). BYOK generation uses your provider key independently and does not require this login.
Sign in
grida auth login
Login opens the system browser and saves a separate CLI session. Complete sign-in on the same machine; Desktop cookies are not used. The command temporarily listens on a registered loopback port and exits when finished. Occupied callback ports cause failure before the browser opens.
To open the sign-in URL yourself:
grida auth login --no-browser
This still needs a browser on the same machine. It is not a remote device-code or headless login. Login requires terminal interaction.
Inspect your session
grida auth status --json
Status reads local metadata without contacting the server or displaying credentials. A saved session is not proof that the server still accepts it. Use account view for an online check. Account commands refresh expired access when possible and otherwise ask you to log in again; they never start login automatically.
Choose credential storage
New profiles use the OS keyring. File storage is an explicit alternative:
grida auth login --storage file
grida auth storage show
grida auth storage migrate keyring
auth storage migrate file switches an existing profile to file storage.
An unavailable keyring never silently selects a file. Account custody currently
supports macOS and Linux and is separate from the BYOK TOML file.
Account profile files live under ~/.grida/auth, or $GRIDA_HOME/auth when an
absolute GRIDA_HOME is supplied. An empty or relative auth home override is
an error. Use the storage commands to change the backend; editing profile files
manually does not revoke a session or safely migrate its credentials.
Sign out
grida auth logout
Logout removes this CLI's credentials and requests remote session revocation.
Local removal still happens offline; unconfirmed revocation is reported with
exit code 1. Already signed out locally is a successful no-op. Logout leaves
provider API keys intact.