relay login for normal CLI sign-in. With no saved credential, it prints a short code and opens auth.relayapp.im in your browser, the OAuth device sign-in; sign in with Google, confirm the code, and the terminal is signed in. Otherwise it checks the saved credential. Never put a token in command arguments.
token: "stored" instead of printing a credential.
For a Console-only sign-in, relay whoami reports the Console user and organization. With an organization API key, it reports the organization. relay logout clears the saved Console credential and any Agent Token in the selected profile.
Use an organization API key
You can also sign in with an existing organization API key. This optional path supportsrel_org_ keys and the legacy rly_org_ format.
organization_key credential. Browser sign-in keeps a Relay session on this computer; Agent Tokens stay in their separate profiles. A rejected key leaves the saved credentials unchanged.
Import an existing Agent Token
Use the hidden compatibility command only when an Agent already exists and you already have its token.Get-Content -Raw $TokenFile | relay auth login --with-token --profile existing. The imported-token path can use RELAY_AGENT_TOKEN; normal relay login does not require that variable.
relay auth logout --profile existing removes only that profile’s Agent Token. Clearing local credentials leaves the Agent at Relay unchanged.

