Log in from the terminal

The CLI signs in through your browser. You approve the request in Rehearsal, and the terminal never sees your password.

Log in #Link to Log in

1. 1

   Step 1: Run the login command

   $ rehearsal login

   Your browser opens a page that asks Allow this terminal to access your Rehearsal projects?

2. 2

   Step 2: Approve the request

   The page lists what the terminal may do. Press Approve. If you did not start this sign-in, press Deny.

3. 3

   Step 3: Return to the terminal

   The CLI shows a welcome and is signed in. The link works for 10 minutes. If it runs out, run rehearsal login again.

On a machine without a browser #Link to On a machine without a browser

$ rehearsal login --no-browser

Open this link to approve the sign-in:  https://app.rehearsal.dev/cli/approve?code=KXQ7M-4TR2PWaiting for approval.

Open the link on any device where you are signed in to Rehearsal. The terminal waits until you approve.

Choose what the CLI may do #Link to Choose what the CLI may do

A sign-in holds up to three scopes. rehearsal login asks for all three.

A scope never adds to your role. The member role can read with the CLI. Starting runs and connecting an app need Manage projects, which the admin and owner roles include.

To ask for less, repeat --scope:

# Read only$ rehearsal login --scope testing:read# Read and run, but no local connections$ rehearsal login --scope testing:read --scope testing:run

Check who you are #Link to Check who you are

$ rehearsal whoami

Maya Chen (maya@parcel.example.com)Signed in to https://api.rehearsal.dev until 2026-10-23T09:12:44.000ZThis sign-in may:  Connect an app on this computer  Read projects, tests, runs and evidence  Start, rerun and stop runsWorkspacesParcel  2f6e1c7a-8d4b-4e0a-9c55-3b1f0d7e6a21  tunnel testing:read testing:run  See what you can do here: rehearsal capabilities --json

• rehearsal whoami shows the account, when the sign-in ends, what it may do and your workspaces.
• rehearsal auth status checks that the saved sign-in still works.
• rehearsal capabilities lists what each workspace lets this sign-in do.

How long a sign-in lasts #Link to How long a sign-in lasts

A sign-in lasts 30 days. After that, commands answer that you are not signed in. Run rehearsal login to start a new one.

The CLI keeps the sign-in in ~/.config/rehearsal/credentials.json, or under $XDG_CONFIG_HOME when that is set. It refuses the file if other users can read it.

Sign out #Link to Sign out

$ rehearsal logout

Rehearsal ends the sign-in, then the CLI deletes the file. If Rehearsal cannot confirm the sign-out, the CLI keeps the file so you can try again.

Scripts and coding agents #Link to Scripts and coding agents

Approval always needs a person. rehearsal login --json does not sign in. It answers with AUTH_REQUIRED and the command a person should run.

A coding agent can run rehearsal login --no-browser and give you the link. You approve it in your browser, and the agent carries on. See Use Rehearsal from your coding agent.

Next steps #Link to Next steps

• Connect a local app so Rehearsal can test it.
• Run tests from the terminal and read their results.