Skip to main content
The CLI signs in through your browser. It does not use an API key, and there is no key to paste or rotate.

​
Sign in

The CLI asks for your workspace subdomain, opens https://<subdomain>.neetodesk.com in your browser and waits while you sign in. Once the browser confirms, the CLI prints the account it authenticated as:
Pass the subdomain up front to skip the prompt:
The browser wait times out after two minutes. Re-run the command if it expires.

​
Where credentials are stored

Credentials are written to ~/.config/neetodesk/auth.json, one entry per workspace, each holding the subdomain, your email address and a session token. Treat the file the way you would treat any other saved session and do not commit it.

​
Several workspaces at once

Signing in to a second workspace adds to the file rather than replacing what is there. When more than one workspace is signed in, pick between them with --subdomain:
neetodesk whoami lists every workspace you are currently signed in to.

​
Sign out

With a single workspace signed in, that is all you need. With several, name the one to drop or clear them all:
Running neetodesk logout with several workspaces signed in and no flag reports which subdomains are authenticated and stops rather than guessing.

​
What the CLI can reach

The CLI acts as the person who signed in, so it sees what that person’s role allows. An agent restricted to their own tickets gets a tickets list narrowed to those tickets. This is the same boundary the MCP server applies to an OAuth connection, and it is the difference between the two credentials NeetoDesk accepts:

​
Pointing at another environment

NEETODESK_BASE_URL overrides the URL the CLI derives from your subdomain. It is meant for local and staging work: