# Signing in

How the command line client signs a machine in to your organisation, and where it keeps that sign-in.


The command line client signs a machine in to one organisation at a time.

```bash
brewless login acme
```

`acme` is the name of your organisation, as in `acme.brewless.eu`.

## How it works

1. The client shows a code, like `ABCD-2345`, and a link, and tries to open the link in your browser.
2. In the console you type the code your terminal shows. The console then shows which machine asked and when; you approve after checking that.
3. The client receives a token of its own for this machine.

The link never carries the code, so a link someone sends you approves nothing by itself. Approve only a sign-in you started yourself, in your own terminal.

Use `--no-browser` when the machine has no browser, and open the link on another device.

A sign-in has to be approved within 10 minutes. Starting one is limited to ten a minute per address, and sixty a minute for the organisation as a whole.

## The token

The token acts as you in that organisation. It works for 90 days and can be ended at any time on the **Account** page of the console.

It is kept on the machine in `~/.config/brewless/credentials.json`, readable by you only. Brewless keeps only a hash of it, which does not depend on any key of Brewless's own, so a sign-in keeps working when Brewless changes its keys.

## In a pipeline

A pipeline does not sign in. It deploys with a pipeline token you make in the console and give it as `BREWLESS_API_TOKEN`. A pipeline token belongs to one application and may only deploy it. See [Deploying from a pipeline](/deployments/from-a-pipeline).

## Signing out

```bash
brewless logout acme
```

This forgets the sign-in on this machine.

## Settings

| Variable | Meaning | Default |
| --- | --- | --- |
| `BREWLESS_HOST` | The domain organisations live under | `brewless.eu` |
| `BREWLESS_HOME` | Where sign-ins are kept | `~/.config/brewless` |
| `BREWLESS_API_TOKEN` | A pipeline token, used instead of the sign-in of the machine | none |