> ## Documentation Index
> Fetch the complete documentation index at: https://apidocs.neetodesk.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Sign in through the browser and manage credentials for one or more workspaces.

The CLI uses your browser to sign you in and securely saves your session, so you never need to enter an API key.

## Sign in

```bash theme={"system"}
neetodesk login --subdomain your-workspace
```

Your browser opens to complete sign-in. The CLI also prints the sign-in URL in case the browser does not open, and waits up to five minutes for you to approve. Once you approve it, the CLI saves credentials for that subdomain. If you omit `--subdomain`, the CLI prompts for it.

<Tip>
  Your subdomain is the first part of your workspace URL - for
  `https://spinkart.neetodesk.com`, the subdomain is `spinkart`. See
  [Workspace subdomain](/cli/workspace-subdomain).
</Tip>

## Where credentials are stored

Credentials for every signed-in workspace live in a single file:

```text theme={"system"}
~/.config/neetodesk/auth.json
```

Removing this file signs you out of every workspace, the same as `neetodesk logout --all`.

## Check who you are

```bash theme={"system"}
neetodesk whoami
```

Lists every signed-in account. When exactly one is signed in, it is marked `(default)`. Pass `--subdomain <name>` to show just one.

## Sign out

```bash theme={"system"}
neetodesk logout --subdomain your-workspace    # remove one workspace
neetodesk logout --all                         # remove every workspace
neetodesk logout                               # remove the only one, if a single workspace is signed in
```

## Working with multiple workspaces

You can sign in to several subdomains at once. To add another workspace, name its subdomain:

```bash theme={"system"}
neetodesk login --subdomain globex
```

When more than one workspace is signed in, every command that talks to the API requires `--subdomain`. If you omit it, the CLI errors and lists the signed-in workspaces.

```bash theme={"system"}
neetodesk tickets list --subdomain acme
neetodesk tickets list --subdomain globex
```

With one signed-in workspace, it is the default and `--subdomain` stays optional.

## Environment variables

`NEETODESK_BASE_URL` overrides the server the CLI talks to. By default every command, including `login`, uses `https://<subdomain>.neetodesk.com`. Set the variable to point the CLI at a staging or local server. Every request, including the session token saved in `~/.config/neetodesk/auth.json`, goes to that server, so only point it at a server you trust:

```bash theme={"system"}
export NEETODESK_BASE_URL=https://acme.neetodesk.net
neetodesk login --subdomain acme
```

## What the CLI can reach

The CLI acts as the person who signed in, so it sees what that person's role allows. An agent restricted to their own tickets gets a `tickets list` narrowed to those tickets. The [MCP server](/mcp/authentication) applies the same boundary to an OAuth connection. An [API key](/api/authentication) reaches the whole workspace instead.

| | CLI session | API key |
| - | - | - |
| Scope | The person who signed in | The whole workspace |
| Set up by | `neetodesk login` | Generating a key in the admin panel |
| Used by | The CLI | Direct API calls |

## Troubleshooting

If sign-in or connection problems come up, run `neetodesk doctor` first. See [Troubleshooting](/cli/troubleshooting) for common issues and fixes.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.