Authentication

The EnvManager CLI supports two authentication methods: browser-based OAuth for local development and API keys for CI/CD pipelines.

Browser Login

For interactive use on your local machine:

envmanager login

This command:

1. Opens your default browser to the EnvManager login page
2. Waits for you to complete authentication
3. Stores credentials securely in ~/.config/envmanager/auth.json

After successful login:

$ envmanager login
Opening browser for authentication...
Authentication successful!

Logged in as yourname@example.com

You can now use envmanager commands.
Run `envmanager list` to see your projects.

Check Current User

envmanager whoami

Shows your current authentication status:

Logged in as yourname@example.com

Organizations:
  - My Company (owner)
  - Client Project (member)

Logout

envmanager logout

Clears stored credentials.

API Keys (CI/CD)

For automated pipelines where browser login isn't possible, use API keys.

Creating API Keys

1. Go to the EnvManager web dashboard
2. Navigate to Settings > API Keys
3. Click Create API key
4. Give the key a name, pick when it expires (90 days is the default), and if you belong to more than one organization, choose the organization it is for
5. Click Create key
6. Copy the key from the dialog — this is the only time it is shown
7. Click I have saved this key to close the dialog

API keys look like: em_abc123...

For the full walkthrough, including how to revoke a key and how to manage signed-in CLI devices, see API Keys.

Using API Keys

Set the ENVMANAGER_API_KEY environment variable:

export ENVMANAGER_API_KEY=em_your_api_key_here
envmanager pull

In CI/CD platforms, add the API key as a secret:

GitHub Actions:

env:
  ENVMANAGER_API_KEY: ${{ secrets.ENVMANAGER_API_KEY }}

GitLab CI:

variables:
  ENVMANAGER_API_KEY: $ENVMANAGER_API_KEY

API Key Permissions

API keys inherit the permissions of the user who created them. They can:

• Read/write variables the user has access to, with exactly the access that user has
• Cannot create new organizations or manage team members

Each key is created for one organization. When you belong to more than one, pass --org "<name>" to name the organization a command should use.

Security Best Practices

1. Rotate keys regularly - Create new keys and revoke old ones periodically
2. Use separate keys per environment - Different keys for staging vs production CI
3. Never commit keys - Always use CI/CD secrets, never hardcode in config files
4. Set expiration - When creating keys, set an expiration date

Credential Storage

Credentials are stored in:

~/.config/envmanager/auth.json

This file has 0600 permissions (owner read/write only). Never share or commit this file.

Troubleshooting

"Not authenticated" error

If you see authentication errors:

# Check if logged in
envmanager whoami

# Re-authenticate
envmanager logout
envmanager login

API key not working

1. Verify the key is correctly set:

   echo $ENVMANAGER_API_KEY
   

2. Check key hasn't expired in the web dashboard
3. Check the key hasn't been revoked. You may have revoked it yourself under Settings > API Keys, or an organization owner or admin may have revoked it — in that case you received an email saying who did.
4. Ensure the user who created the key has access to the project