# Log in from the terminal

> Sign in from your terminal, choose what the CLI may do, and sign out.

Source: https://rehearsal.dev/docs/cli/log-in

The CLI signs in through your browser. You approve the request in Rehearsal, and the terminal never sees your password.

## Log in

1. **Run the login command**

   ```sh
   rehearsal login
   ```

   Your browser opens a page that asks **Allow this terminal to access your Rehearsal projects?**

2. **Approve the request**

   The page lists what the terminal may do. Press **Approve**. If you did not start this sign-in, press **Deny**.

3. **Return to the terminal**

   The CLI shows a welcome and is signed in. The link works for 10 minutes. If it runs out, run `rehearsal login` again.

### On a machine without a browser

```sh
rehearsal login --no-browser
```

```text
Open this link to approve the sign-in:
  https://app.rehearsal.dev/cli/approve?code=KXQ7M-4TR2P
Waiting for approval.
```

Open the link on any device where you are signed in to Rehearsal. The terminal waits until you approve.

## Choose what the CLI may do

A sign-in holds up to three scopes. `rehearsal login` asks for all three.

| Scope | What it allows | Permission it needs |
| --- | --- | --- |
| `testing:read` | Read projects, tests, runs and evidence | **View projects** |
| `testing:run` | Start, rerun and stop runs | **Manage projects** |
| `tunnel` | Connect an app on this computer | **Manage projects** |

A scope never adds to your role. The member role can read with the CLI. Starting runs and connecting an app need **Manage projects**, which the admin and owner roles include.

To ask for less, repeat `--scope`:

```sh
# Read only
rehearsal login --scope testing:read
# Read and run, but no local connections
rehearsal login --scope testing:read --scope testing:run
```

> [!NOTE]
> Logging in again replaces the sign-in on this computer and ends any connection the old one opened. Ask for every scope you still need.

## Check who you are

```sh
rehearsal whoami
```

```text
Maya Chen (maya@parcel.example.com)
Signed in to https://api.rehearsal.dev until 2026-10-23T09:12:44.000Z
This sign-in may:
  Connect an app on this computer
  Read projects, tests, runs and evidence
  Start, rerun and stop runs

Workspaces
Parcel  2f6e1c7a-8d4b-4e0a-9c55-3b1f0d7e6a21  tunnel testing:read testing:run
  See what you can do here: rehearsal capabilities --json
```

- `rehearsal whoami` shows the account, when the sign-in ends, what it may do and your workspaces.
- `rehearsal auth status` checks that the saved sign-in still works.
- `rehearsal capabilities` lists what each workspace lets this sign-in do.

## How long a sign-in lasts

A sign-in lasts 30 days. After that, commands answer that you are not signed in. Run `rehearsal login` to start a new one.

The CLI keeps the sign-in in `~/.config/rehearsal/credentials.json`, or under `$XDG_CONFIG_HOME` when that is set. It refuses the file if other users can read it.

## Sign out

```sh
rehearsal logout
```

Rehearsal ends the sign-in, then the CLI deletes the file. If Rehearsal cannot confirm the sign-out, the CLI keeps the file so you can try again.

## Scripts and coding agents

Approval always needs a person. `rehearsal login --json` does not sign in. It answers with `AUTH_REQUIRED` and the command a person should run.

A coding agent can run `rehearsal login --no-browser` and give you the link. You approve it in your browser, and the agent carries on. See [Use Rehearsal from your coding agent](https://rehearsal.dev/docs/coding-agents/use-rehearsal.md).

## Next steps

- [Connect a local app](https://rehearsal.dev/docs/cli/connect-a-local-app.md) so Rehearsal can test it.
- [Run tests from the terminal](https://rehearsal.dev/docs/cli/run-tests.md) and read their results.