> For the complete documentation index, see [llms.txt](https://developer.celigo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.celigo.com/cli/getting-started/authenticate.md).

# Authenticate

The CLI accepts any integrator.io bearer token: an admin-created service token, or a [personal access token](https://developer.celigo.com/api/getting-started/authentication) (PAT) you create yourself. A PAT inherits your own user permissions. Create either in **Resources → API tokens**.

The CLI reads the token from, in priority order:

1. `--token <value>` CLI flag (one-off override)
2. `CELIGO_API_TOKEN` environment variable
3. The active profile in `~/.celigo/config.json`
4. Error, no token available

The base URL follows the same priority via `--base-url`, `CELIGO_BASE_URL`, or the profile's `base_url`. Default: `https://api.integrator.io`.

## One account

```bash
export CELIGO_API_TOKEN="<paste>"
celigo workspace-users list --format table
```

Works on macOS, Linux, and Windows. In PowerShell: `$env:CELIGO_API_TOKEN = "..."`.

#### With a config file

If you'd rather not re-export the env var every shell session:

> ⚠️ **This stores your API token in plaintext on disk.** `~/.celigo/config.json` holds the raw token; keep its `0600` permissions and never commit it to version control.

```bash
celigo config set api_token "<paste>"
celigo config show
```

This writes `~/.celigo/config.json` with mode `0600` on Unix (owner read/write only; Windows uses NTFS ACLs scoped to the current user).

## Multiple accounts: profiles

One binary, many accounts — typical setup is one profile per region or per environment.

```bash
celigo profile add us --api-token "$US_TOKEN" --api-base-url https://api.integrator.io
celigo profile add eu --api-token "$EU_TOKEN" --api-base-url https://api.eu.integrator.io
celigo profile add au --api-token "$AU_TOKEN" --api-base-url https://api.au.integrator.io
celigo profile add ca --api-token "$CA_TOKEN" --api-base-url https://api.ca.integrator.io

celigo profile list
celigo profile use us               # set default
celigo --profile eu flows list      # one-off override
```

Full details in [Profiles & regions](/cli/getting-started/profiles.md).

## Verify authentication

Resolve the active profile's token to the user it authenticates as with `profile whoami` (calls `GET /v1/tokenInfo`):

```bash
celigo profile whoami
```

Any authenticated read also works as a smoke test:

```bash
celigo workspace-users list --format json
```

A successful response confirms the token is valid. A `401 Unauthorized` means the token is missing, expired, revoked, or pointed at the wrong region. A token authenticates only against its own region's base URL.

To see your stored config without making an API call:

```bash
celigo config show          # active profile
celigo profile show us      # a specific profile
```

Tokens are redacted in all output — first 4 and last 4 characters visible, the rest masked.

## Security

* Tokens are **redacted** in all CLI output.
* `~/.celigo/config.json` is written with `0600` permissions. Don't `chmod` it wider.
* `--verbose` redacts the `Authorization` header in its HTTP traces.
* Never commit `~/.celigo/config.json` or any script with `--token <value>` hard-coded.
* For CI, pass a short-lived token via the CI secret store and set `CELIGO_API_TOKEN` at job time.

## Rotating

```bash
# Update the active profile's token in place
celigo config set api_token "<new>"
celigo profile whoami            # verify

# Then revoke the old token in the UI under Resources → API tokens.
```

For profile-based setups, there is no `profile edit` — either `config set` against the active profile, or `profile delete` + `profile add` to re-enter credentials cleanly.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://developer.celigo.com/cli/getting-started/authenticate.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.