Authenticate the CLI with an Entri API token. The token is stored locally and used automatically for all subsequent commands.
Usage
Interactive mode
Running nt3 login without flags opens an interactive prompt:
Non-interactive mode
Pass the token directly with the -t flag for use in scripts and CI/CD:
Options
Where credentials are stored
By default, credentials are saved to ~/.nt3/config.json with 600 (owner read/write only) file permissions.
Folder-scoped login — use the --local flag to save credentials to .nt3.local.json in the current directory instead:
This is useful when you need different tokens for different projects on the same machine. The local config takes priority over the global config.
Add .nt3.local.json to your .gitignore to avoid accidentally committing credentials. The CLI prints a reminder when you use --local.
Token priority order
The CLI resolves which token to use in this order:
NT3_API_TOKEN environment variable (highest priority).nt3.local.json in the current working directory~/.nt3/config.json (global)
Run nt3 status at any time to see which token source is currently active.
Custom API URL
If you are running Entri on a self-hosted or staging instance, pass the base URL:
The custom URL is saved alongside the token and used for all subsequent API calls.
Token validation
The CLI validates that your token starts with entri_ before saving it. If the token format is invalid, login will fail with an error:
Logging out
To remove stored credentials:
