> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nt3.io/llms.txt
> Use this file to discover all available pages before exploring further.

# nt3 login

> Authenticate the CLI with your Entri account.

Authenticate the CLI with an Entri API token. The token is stored locally and used automatically for all subsequent commands.

## Usage

```bash theme={null}
nt3 login [options]
# alias: nt3 auth
```

## Interactive mode

Running `nt3 login` without flags opens an interactive prompt:

```bash theme={null}
nt3 login
```

```
To create an API token, visit your nt3 dashboard > Settings > API Tokens

Paste your API token: ****
Login successful! Token saved to ~/.nt3/config.json
```

## Non-interactive mode

Pass the token directly with the `-t` flag for use in scripts and CI/CD:

```bash theme={null}
nt3 login -t entri_your_token_here
```

## Options

| Flag                  | Description                                                        |
| --------------------- | ------------------------------------------------------------------ |
| `-t, --token <token>` | API token (skips the interactive prompt)                           |
| `-u, --api-url <url>` | Custom API URL (default: `https://app.nt3.io`)                     |
| `-l, --local`         | Save credentials to `.nt3.local.json` instead of the global config |

## Where credentials are stored

By default, credentials are saved to `~/.nt3/config.json` with `600` (owner read/write only) file permissions.

**Folder-scoped login** — use the `--local` flag to save credentials to `.nt3.local.json` in the current directory instead:

```bash theme={null}
nt3 login --local -t entri_your_token_here
```

This is useful when you need different tokens for different projects on the same machine. The local config takes priority over the global config.

<Warning>
  Add `.nt3.local.json` to your `.gitignore` to avoid accidentally committing credentials. The CLI prints a reminder when you use `--local`.
</Warning>

## Token priority order

The CLI resolves which token to use in this order:

1. `NT3_API_TOKEN` environment variable (highest priority)
2. `.nt3.local.json` in the current working directory
3. `~/.nt3/config.json` (global)

Run `nt3 status` at any time to see which token source is currently active.

## Custom API URL

If you are running Entri on a self-hosted or staging instance, pass the base URL:

```bash theme={null}
nt3 login -t entri_your_token -u https://staging.yourcompany.com
```

The custom URL is saved alongside the token and used for all subsequent API calls.

## Token validation

The CLI validates that your token starts with `entri_` before saving it. If the token format is invalid, login will fail with an error:

```
Invalid token format. Tokens should start with "entri_"
```

## Logging out

To remove stored credentials:

```bash theme={null}
nt3 logout          # Remove token from ~/.nt3/config.json
nt3 logout --local  # Remove token from .nt3.local.json
```