> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sabaothcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# sabaoth login

> Sign in with an API key and select the organization it belongs to

Checks an API key with the API, finds the organization it gives access to, saves the key in the OS keychain and selects that organization.

```bash theme={null}
sabaoth login [--api-key <key>] [--org <org-id>] [--json]
```

## Flags

**--api-key** `string`

The API key to use. If you leave it out, the CLI asks for it with a hidden prompt. The key is recorded in your shell history when passed this way, so prefer the prompt, or `SABAOTH_API_KEY` for automation.

**--org** `string`

The organization to sign in to, when the key gives access to more than one. Required in that case.

**--json** `boolean` (default: false)

Print the result as JSON on stdout.

## Examples

```bash theme={null}
# Hidden prompt (recommended)
sabaoth login

# Key gives access to several organizations
sabaoth login --org org_abc

# Pass the key directly (ends up in shell history)
sabaoth login --api-key mpg_xxxxxxxx
```

## Output

```text theme={null}
$ sabaoth login
Sabaoth API key:
Logged in to Acme (org_abc).
```

With `--json`:

```json theme={null}
{
  "logged_in": true,
  "organization": { "id": "org_abc", "display_name": "Acme" }
}
```

If you used `--api-key`, the JSON result also includes a `warnings` array with the shell history warning.

## Behavior

* **The key is checked before anything is saved.** A mistyped or revoked key never leaves a credential behind.
* **Keys are stored only in the OS keychain**, under service `com.sabaothcloud.sabaoth` and account `org:<organization-id>`. There is no plain-text fallback.
* **Logging in selects the organization.** Logging in to a second organization adds it alongside the first and makes it the selected one.
* **Logging in again to the same organization** replaces its stored key.
* **No reading from pipes.** Without a terminal and without `--api-key`, login exits with code `2` instead of reading a key from standard input.

## Errors

| Code | Exit | Meaning |
| - | - | - |
| `API_KEY_UNAUTHORIZED` | 1 | The API rejected the key. Check it was copied completely and hasn't been revoked or expired. |
| `NO_ORGANIZATION_ACCESS` | 1 | The key is valid but gives access to no organization. |
| `AMBIGUOUS_ORGANIZATION` | 2 | The key covers several organizations. Re-run with `--org` and one of the listed IDs. |
| `ORGANIZATION_MISMATCH` | 2 | The key doesn't cover the organization passed with `--org`. |
| `CREDENTIAL_STORE_UNAVAILABLE` | 1 | The OS keychain couldn't be reached, so nothing was saved. Unlock it and retry, or use `SABAOTH_API_KEY`. |
| `NO_TTY_FOR_PROMPT` | 2 | No terminal for the hidden prompt. Pass `--api-key` or use `SABAOTH_API_KEY`. |
| `EMPTY_API_KEY` | 2 | No key was entered. |

See [Error codes](https://docs.sabaothcloud.com/cli/errors.md) for network and server errors.

## Related

* [Authentication](https://docs.sabaothcloud.com/cli/authentication.md)
* [`sabaoth logout`](https://docs.sabaothcloud.com/cli/commands/logout)
* [`sabaoth org use`](https://docs.sabaothcloud.com/cli/commands/org-use)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.