> ## Documentation Index
> Fetch the complete documentation index at: https://docs.relayapp.im/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Sign in to Relay Console from the CLI, or import an existing Agent Token.

Use `relay login` for normal CLI sign-in. With no saved credential, it prints a short code and opens auth.relayapp.im in your browser, the OAuth device sign-in; sign in with Google, confirm the code, and the terminal is signed in. Otherwise it checks the saved credential. **Never put a token in command arguments.**

```bash theme={null}
relay login
relay whoami
```

On your first sign-in, Relay creates your organization for you.

The staging CLI selects staging API and Console endpoints automatically. Credentials are stored privately in Relay's local configuration, and the CLI reports `token: "stored"` instead of printing a credential.

For a Console-only sign-in, `relay whoami` reports the Console user and organization. With an organization API key, it reports the organization. `relay logout` clears the saved Console credential and any Agent Token in the selected profile.

## Use an organization API key

You can also sign in with an existing organization API key. This optional path supports `rel_org_` keys and the legacy `rly_org_` format.

```bash theme={null}
printf '%s\n' "$RELAY_ORG_KEY" | relay login --with-token
relay whoami
```

The CLI checks the key with Relay Console before saving it as an `organization_key` credential. Browser sign-in keeps a Relay session on this computer; Agent Tokens stay in their separate profiles. A rejected key leaves the saved credentials unchanged.

## Import an existing Agent Token

Use the hidden compatibility command only when an Agent already exists and you already have its token.

```bash theme={null}
printf '%s\n' "$RELAY_AGENT_TOKEN" | relay auth login --with-token --profile existing
relay auth status --profile existing
relay auth logout --profile existing
```

The token is read from stdin and stored privately. On Windows PowerShell, use `Get-Content -Raw $TokenFile | relay auth login --with-token --profile existing`. The imported-token path can use `RELAY_AGENT_TOKEN`; normal `relay login` does not require that variable.

`relay auth logout --profile existing` removes only that profile's Agent Token. Clearing local credentials leaves the Agent at Relay unchanged.

## Local runtime development

For local runtime development, use the [runtime connection guide](/cli/connect). A Console-created Agent is saved with its runtime credential locally, then the selected integration is configured. A deployed Agent that is owned and run by Relay Console does not need a local runtime connection.

[Create an agent](/agents/create-agent) · [Delete an agent](/agents/delete-agent) · [Claude Code integration](/integrations/claude-code) · [Organization commands](/cli/reference/organization-show)

## Next steps

* [CLI overview](/cli)
* [Console](/console)
* [API overview](/api-reference/overview)