Authentication

The CLI supports two auth modes: browser-based session login for interactive use and a project API key for CI and headless environments.

Sign in through your browser using the OAuth 2.0 device authorization flow. Opens a verification URL, displays a user code, and polls until you approve in the browser.

inf auth login

After sign-in, the CLI stores a session token in ~/.inf/config.json and activates an organization (team). If your account belongs to multiple teams, inf auth login prompts you to choose one in an interactive terminal.

Options

Option	Required	Description
`--team <id-or-slug>`	No	Activate a specific team by ID, slug, or exact team name

Team selection

Use --team when you know which team you want to activate, or when running in a non-interactive shell.

inf auth login --team acme

You can pass a team ID, slug, or exact team name:

inf auth login --team team_abc123
inf auth login --team acme
inf auth login --team "Acme Research"

If the selected team is different from the previously active team, the CLI clears the stored active project and then tries to auto-select a project from the newly active team. You can always run inf project list and inf project switch <id> to pick a different project.

inf auth login --team only sets the team activated at sign-in. Once signed in, you have two ways to work with a different team without signing in again: inf team switch <id-or-slug> stores a new active team in your config, while the global -t, --team <id> flag (or INF_TEAM_ID) overrides the team for a single command only and does not change your stored active team. See Teams.

In non-interactive environments, inf auth login cannot prompt for a team. If you belong to multiple teams and omit --team, the CLI falls back to the first team returned by the auth API. Pass --team <id-or-slug> to make the selected team deterministic.

Session login requires a browser, so inf auth login is not suitable for CI or other headless environments. Use inf auth set-key or the INF_API_KEY env var there instead.

`inf auth set-key`

Store a project API key on disk for headless or CI authentication.

inf auth set-key <key>

Arguments

Argument	Required	Description
`key`	Yes	A project API key (starts with `sk-inference-`)

After saving, the CLI validates the key by fetching the project list. A successful fetch auto-selects the first project as active.

Example

inf auth set-key sk-inference-...

`inf auth status`

Show who you're signed in as, which auth method the CLI is using, the active team and project, and the API URL.

inf auth status

`inf auth whoami`

Show your user ID, email, name, and the team the next command will target.

inf auth whoami

Use inf auth status for a broader view that also includes the auth method and active project. Use whoami when you only need identity and team, for example in a script.

With a project API key, whoami shows your user ID and team but not your email or name, since a project API key is not tied to a specific person.

`inf auth logout`

Sign out, clear the session token / API key from ~/.inf/config.json, and forget the active project and team.

inf auth logout

Logout disconnects every connected coding agent before it clears credentials. Use --keep-coding-agents to leave agent gateway config in place. Use --revoke-coding-agent-key to revoke the minted coding-agent key before logout. The two flags are mutually exclusive. See Coding-agent troubleshooting for the full behavior.

Credential resolution order

When multiple credentials are present, the CLI picks the first match:

INF_API_KEY environment variable
API key stored via inf auth set-key
Session token stored via inf auth login

The coding-agent on commands use a parallel resolution that can mint a project key. See Coding Agents.

inf instrument is the one exception — it rejects INF_API_KEY and requires a session login, because it mints a fresh API key for your project on your behalf. Unset INF_API_KEY and run inf auth login before running inf instrument.

Configuration

The CLI stores configuration at ~/.inf/config.json, created automatically on first login. Tokens are stored with 0600 permissions.

Environment variables

Variable	Description	Default
`INF_API_KEY`	API key for authentication. Takes precedence over stored credentials	—
`INF_API_URL`	Override the API base URL	`https://observability-api.inference.net`
`INF_PROJECT_ID`	Override the active project for any invocation (equivalent to `--project <id>` global)	—
`INF_TEAM_ID`	Override the active team for any invocation (equivalent to `--team <id>` global)	—

--team and INF_TEAM_ID take a team ID, not a slug or name. Use inf team switch <id-or-slug> once to resolve a slug or name to an ID, or run inf team list to look one up.

Authentication

On this page