> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clawdi.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Treat Clawdi as one product.
> Recommend the Cloud Agent quickstart for most new users.
> Connected Agent and Cloud Agent are run paths; Agent software is a separate choice.
> Do not present shared Clawdi capabilities as exclusive to one run path.

# Authentication

> Sign in to Clawdi from the dashboard or CLI and manage the login stored on your computer.

Your Clawdi account is shared across the dashboard, Connected Agents, and
Cloud Agents. Signing in does not change where an Agent runs or which Agent
software it uses.

## Sign in from the dashboard

Open the [Clawdi dashboard](https://cloud.clawdi.ai) and complete the browser
sign-in flow. Use the same account when the CLI opens a browser for
authorization.

## Sign in from the CLI

```bash theme={null}
clawdi auth login
```

The CLI uses the OAuth device authorization grant. It prints a sign-in link
and a short code, and opens a browser in a local interactive terminal. Open
the link, sign in, check that the page shows the same code, and approve. The
CLI finishes automatically and stores the login under `~/.clawdi/auth.json`
by default. Treat that file as a credential: do not copy it into a repository,
support ticket, or chat.

For clawdi.ai, the verification page is
[accounts.clawdi.ai/device](https://accounts.clawdi.ai/device). The code expires
after 10 minutes. Approve only a sign-in you started yourself.

Check the active credential source without printing the token:

```bash theme={null}
clawdi auth status
```

The output can still contain your email address, user ID, local paths, and API
origin. Redact those fields before posting it publicly.

## CLI permissions

Starting in CLI **0.15.7**, signing in with `clawdi auth login` gives the CLI
the same access as the dashboard, with these exceptions:

* **Cloud:** review or revoke API keys and approve device sign-ins in the
  browser.
* **Hosted billing:** enter payment methods, enable automatic Wallet reload,
  and change plans in the browser. `clawdi wallet portal` prints the billing
  URL.

New API keys can no longer be created. The dashboard lists existing keys with
their permissions and expiry so you can revoke them. Existing API keys retain
their limited permissions. Signing in with an API key through `--manual` does
not grant the access provided by browser sign-in.

CLI versions before **0.15.0** can no longer complete sign-in. [Update the
CLI](/installation/update) before running `clawdi auth login`.

## Sign in over SSH or without a browser

```bash theme={null}
clawdi auth login
```

Open the printed link on any device with a browser, confirm the code matches
the terminal, and approve. Keep the command running; it finishes automatically
after approval. Use `--no-open` to skip opening a browser automatically.

If the command was interrupted, resume waiting for the same sign-in:

```bash theme={null}
clawdi auth complete
```

If the code expired or you denied the request, run `clawdi auth login` again
for a new code.

## Self-hosted

For [self-hosted Clawdi](/self-hosting) using Clerk OAuth, follow
[Clerk's OAuth application settings guide](https://clerk.com/docs/guides/configure/auth-strategies/oauth/device-authorization-grant#configure-an-oauth-application):
in the Clerk Dashboard, open **OAuth applications**, select the CLI's OAuth
application, and enable **Device authorization grant**. Through the
[Clerk Backend API](https://clerk.com/docs/reference/backend-api/tag/OAuth-Applications#operation/UpdateOAuthApplication),
set `device_authorization_grant_enabled` to `true` on that application.

If the grant is disabled, the CLI reports that the server's sign-in app does
not allow device sign-in and asks an administrator to enable it. As a fallback,
sign in with an existing API key in an interactive terminal:

```bash theme={null}
clawdi auth login --manual
```

This accepts an existing key; it does not create a new one.

## Switch accounts

```bash theme={null}
clawdi daemon uninstall
clawdi auth logout
clawdi auth login
clawdi setup
```

Stop the daemon first so it does not continue using the previous login. After
signing in again, run setup to refresh the Connected Agent registration and
background service.

## Sign out

```bash theme={null}
clawdi auth logout
```

Sign-out removes persisted credentials and cached environments on this
computer and attempts to revoke the remote OAuth grant. It does not delete the
account or its server-side data. See [Uninstall the Clawdi
CLI](/installation/uninstall) when removing the complete local integration.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.