flitz login / logout
Sign in to Flitz from the CLI once per machine, and sign out again.
Sign in once per machine. Every command that needs a credential — downloading
an SDK, reading the loader-plugin credentials, publishing — uses the stored
sign-in from then on. CI jobs do not sign in; they set
FLITZ_APIKEY instead.
login
flitz loginlogin prints a link and a short code, opens the link in your browser when it
can (open on macOS, xdg-open on Linux), and waits:
Sign in to Flitz from a browser:
Open https://…
Code ABCD-EFGH
⠋ Waiting for approval 4.2sApprove the sign-in in a browser on any device — it does not have to be the
machine running the CLI. When the approval arrives, the CLI stores the
credential and prints ✓ Signed in to Flitz.
Signing in does not itself check your organization's license. Each licensed
command goes straight to the endpoint that does its work and reports what that
endpoint answered, so you are never told the same thing twice. An inactive
license shows up as your organization's Flitz license is not active with a
hint to contact your administrator — run flitz status
to see the license row directly.
When sign-in fails
| Message | Meaning | Next step |
|---|---|---|
the sign-in was declined | You (or whoever held the browser) rejected the request. | flitz login again. |
the sign-in code expired before it was approved | The code timed out. | flitz login again for a fresh code. |
this Flitz build was rejected by the sign-in service | The CLI binary is out of date or from another environment. | Re-run the install script for a current CLI. |
the sign-in service could not be reached | Network. | Retry; report it if it persists. |
All but the last are exit 3; the last is exit 4.
logout
flitz logoutDeletes the stored credential from this machine and prints Logged out. (or
Not logged in. when there was nothing to delete). Exits 0 either way.
Where credentials are stored
The sign-in credential lives outside any project repository:
~/.config/flitz/credentials.json (or $XDG_CONFIG_HOME/flitz/credentials.json)It is written atomically at mode 0600, never committed, never printed, and
redacted from every diagnostic, including -v output and the
bug-report capture. It holds a
long-lived refresh credential; the short-lived tokens actually sent with each
request are derived from it in memory on demand.
When that refresh is rejected — the session was revoked, expired, or ended by
an administrator — the CLI reports your Flitz session has ended with the
flitz login hint (exit 3), never a stack trace.
FLITZ_APIKEY takes precedence
When FLITZ_APIKEY is set and non-empty, the whole CLI authenticates with it
and never reads the stored credential. flitz login is not needed and the
ambient update notice is suppressed. See flitz apikey.
Access and revocation
- Granting access is done by your organization's administrator, who adds you to the licensed organization.
- Revoking a developer, a pipeline's API key, or a whole organization's license takes effect within minutes: no new SDK downloads, plugin credentials, or publishes.
- Bytes already on disk keep working. Revocation governs new downloads and updates only; a cached SDK builds fully offline. This is inherent to a self-contained toolchain — see Troubleshooting → Offline behavior.