Authenticate the CLI with an Entri API token. The token is stored locally and used automatically for all subsequent commands.
Usage
nt3 login [options]
# alias: nt3 auth
Interactive mode
Running nt3 login without flags opens an interactive prompt:
To create an API token, visit your nt3 dashboard > Settings > API Tokens
Paste your API token: ****
Login successful! Token saved to ~/.nt3/config.json
Non-interactive mode
Pass the token directly with the -t flag for use in scripts and CI/CD:
nt3 login -t entri_your_token_here
Options
| Flag | Description |
|---|
-t, --token <token> | API token (skips the interactive prompt) |
-u, --api-url <url> | Custom API URL (default: https://app.nt3.io) |
-l, --local | Save credentials to .nt3.local.json instead of the global config |
Where credentials are stored
By default, credentials are saved to ~/.nt3/config.json with 600 (owner read/write only) file permissions.
Folder-scoped login — use the --local flag to save credentials to .nt3.local.json in the current directory instead:
nt3 login --local -t entri_your_token_here
Add .nt3.local.json to your .gitignore to avoid accidentally committing credentials. The CLI prints a reminder when you use --local.
Token priority order
The CLI resolves which token to use in this order:
NT3_API_TOKEN environment variable (highest priority).nt3.local.json in the current working directory~/.nt3/config.json (global)
Run nt3 status at any time to see which token source is currently active.
Custom API URL
If you are running Entri on a self-hosted or staging instance, pass the base URL:
nt3 login -t entri_your_token -u https://staging.yourcompany.com
Token validation
The CLI validates that your token starts with entri_ before saving it. If the token format is invalid, login will fail with an error:
Invalid token format. Tokens should start with "entri_"
Logging out
To remove stored credentials:
nt3 logout # Remove token from ~/.nt3/config.json
nt3 logout --local # Remove token from .nt3.local.json
