# CLI Authentication

The CLI supports browser-based user authorization and project API keys. Local profiles store the
selected credential, API origin, OTLP origin, and default project context.

## Interactive Login

```bash
provon auth login
```

The command opens a browser, completes authorization through a loopback callback, and stores a
user-access credential in the active profile. Use `--no-open` to print the authorization URL
instead.

Optional flags:

```text
--profile <name>      Profile name
--timeout-ms <ms>     Maximum time to wait for browser authorization (default 120000)
--no-open             Print the authorization URL instead of opening a browser
```

Inspect or remove the profile:

```bash
provon auth status
provon auth logout
```

## Project API Key

Use an API key for service automation:

```bash
provon auth token set \
  --api-key "$PROVON_API_KEY" \
  --project "$PROVON_PROJECT_ID"
```

Optional flags:

```text
--api-key <key>       Provon project API key
--project <id>        Default project id for workspace-scoped routes
--profile <name>      Profile name
```

The key's capabilities determine which commands can run. For example, trace reads require
`telemetry:read`, Finding mutations require `diagnostics:write`, and Gateway calls require
`gateway:invoke`.

See [API authentication](../api/authentication.md) for the complete capability model.

## Project Context

List available projects and select the default:

```bash
provon workspace projects list
provon project use <project-id>
provon project current
```

Commands that use project-qualified Workspace routes require a selected project.

## Profiles And Overrides

Use `--profile <name>` to keep multiple environments or identities separate. Resolution follows
this order:

1. command-line flags;
2. environment variables;
3. the selected local profile;
4. built-in defaults.

Common environment variables are:

```text
PROVON_API_KEY
PROVON_PROJECT_ID
PROVON_PROFILE
PROVON_API_URL
```

## Configure Origins

```bash
provon config get
provon config set api-url http://127.0.0.1:3000/v1
provon config set otel-url http://127.0.0.1:3000/v1
```

Set the API and OTLP origins independently for split or self-hosted deployments. Supported settings
are `api-url` and `otel-url`.