> ## Documentation Index
> Fetch the complete documentation index at: https://apidocs.neetodesk.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Sign in to a NeetoDesk workspace, work across several workspaces and sign out.

The CLI signs in through your browser. It does not use an
[API key](/getting-started/authentication), and there is no key to paste or rotate.

## Sign in

```bash theme={"system"}
neetodesk login
```

The CLI asks for your workspace subdomain, opens
`https://<subdomain>.neetodesk.com` in your browser and waits while you sign in. Once the
browser confirms, the CLI prints the account it authenticated as:

```
Opening browser for authentication...
Waiting for authentication... done!
Authenticated as oliver.smith@example.com on acme.neetodesk.com.
```

Pass the subdomain up front to skip the prompt:

```bash theme={"system"}
neetodesk login --subdomain acme
```

The browser wait times out after two minutes. Re-run the command if it expires.

## Where credentials are stored

Credentials are written to `~/.config/neetodesk/auth.json`, one entry per workspace, each
holding the subdomain, your email address and a session token. Treat the file the way you would
treat any other saved session and do not commit it.

## Several workspaces at once

Signing in to a second workspace adds to the file rather than replacing what is there. When more
than one workspace is signed in, pick between them with `--subdomain`:

```bash theme={"system"}
neetodesk tickets list --subdomain acme
neetodesk tickets list --subdomain globex
```

`neetodesk whoami` lists every workspace you are currently signed in to.

## Sign out

```bash theme={"system"}
neetodesk logout
```

With a single workspace signed in, that is all you need. With several, name the one to drop or
clear them all:

<CodeGroup>
  ```bash One workspace theme={"system"}
  neetodesk logout --subdomain acme
  ```

  ```bash All workspaces theme={"system"}
  neetodesk logout --all
  ```
</CodeGroup>

Running `neetodesk logout` with several workspaces signed in and no flag reports which
subdomains are authenticated and stops rather than guessing.

## What the CLI can reach

The CLI acts as the person who signed in, so it sees what that person's role allows. An agent
restricted to their own tickets gets a `tickets list` narrowed to those tickets. This is the same
boundary the [MCP server](/mcp/authentication) applies to an OAuth connection, and it is the
difference between the two credentials NeetoDesk accepts:

|           | CLI session              | API key                             |
| --------- | ------------------------ | ----------------------------------- |
| Scope     | The person who signed in | The whole workspace                 |
| Set up by | `neetodesk login`        | Generating a key in the admin panel |
| Used by   | The CLI                  | Direct API calls                    |

## Pointing at another environment

`NEETODESK_BASE_URL` overrides the URL the CLI derives from your subdomain. It is meant for
local and staging work:

```bash theme={"system"}
NEETODESK_BASE_URL=http://acme.lvh.me:3000 neetodesk tickets list
```