> For the complete documentation index, see [llms.txt](https://developer.celigo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.celigo.com/cli/getting-started/authenticate.md).

# Authenticate

The CLI accepts any integrator.io bearer token: an admin-created service token, or a [personal access token](https://developer.celigo.com/api/getting-started/authentication) (PAT) you create yourself. A PAT inherits your own user permissions. Create either in **Resources → API tokens**.

The CLI reads the token from, in priority order:

1. `--token <value>` CLI flag (one-off override)
2. `CELIGO_API_TOKEN` environment variable
3. The active profile in `~/.celigo/config.json`
4. Error, no token available

The base URL follows the same priority via `--base-url`, `CELIGO_BASE_URL`, or the profile's `base_url`. Default: `https://api.integrator.io`.

## One account

```bash
export CELIGO_API_TOKEN="<paste>"
celigo workspace-users list --format table
```

Works on macOS, Linux, and Windows. In PowerShell: `$env:CELIGO_API_TOKEN = "..."`.

#### With a config file

If you'd rather not re-export the env var every shell session:

> ⚠️ **This stores your API token in plaintext on disk.** `~/.celigo/config.json` holds the raw token; keep its `0600` permissions and never commit it to version control.

```bash
celigo config set api_token "<paste>"
celigo config show
```

This writes `~/.celigo/config.json` with mode `0600` on Unix (owner read/write only; Windows uses NTFS ACLs scoped to the current user).

## Multiple accounts: profiles

One binary, many accounts — typical setup is one profile per region or per environment.

```bash
celigo profile add us --api-token "$US_TOKEN" --api-base-url https://api.integrator.io
celigo profile add eu --api-token "$EU_TOKEN" --api-base-url https://api.eu.integrator.io
celigo profile add au --api-token "$AU_TOKEN" --api-base-url https://api.au.integrator.io
celigo profile add ca --api-token "$CA_TOKEN" --api-base-url https://api.ca.integrator.io

celigo profile list
celigo profile use us               # set default
celigo --profile eu flows list      # one-off override
```

Full details in [Profiles & regions](/cli/getting-started/profiles.md).

## Verify authentication

Resolve the active profile's token to the user it authenticates as with `profile whoami` (calls `GET /v1/tokenInfo`):

```bash
celigo profile whoami
```

Any authenticated read also works as a smoke test:

```bash
celigo workspace-users list --format json
```

A successful response confirms the token is valid. A `401 Unauthorized` means the token is missing, expired, revoked, or pointed at the wrong region. A token authenticates only against its own region's base URL.

To see your stored config without making an API call:

```bash
celigo config show          # active profile
celigo profile show us      # a specific profile
```

Tokens are redacted in all output — first 4 and last 4 characters visible, the rest masked.

## Security

* Tokens are **redacted** in all CLI output.
* `~/.celigo/config.json` is written with `0600` permissions. Don't `chmod` it wider.
* `--verbose` redacts the `Authorization` header in its HTTP traces.
* Never commit `~/.celigo/config.json` or any script with `--token <value>` hard-coded.
* For CI, pass a short-lived token via the CI secret store and set `CELIGO_API_TOKEN` at job time.

## Rotating

```bash
# Update the active profile's token in place
celigo config set api_token "<new>"
celigo profile whoami            # verify

# Then revoke the old token in the UI under Resources → API tokens.
```

For profile-based setups, there is no `profile edit` — either `config set` against the active profile, or `profile delete` + `profile add` to re-enter credentials cleanly.