Get startedCLIAPIMCPWebDesktopAgentsSupportBillingChangelog
These docs are outdated. This section is no longer maintained. Current guides live in the Help Center.
CLI · Setup

Authentication

The CLI signs in you, not an agent. One command, one browser approval, and the credential lives in your keychain.

How it works

The Dock CLI authenticates you, the signed-in human account holder, not an agent. Running dock login starts a browser device-approval flow: you approve the request in Dock, and the CLI receives a human-scoped credential (a dock_cli_token). That token is stored in your operating system's keychain (macOS Keychain, Windows Credential Vault, or libsecret via keytar) on your own machine; Dock's servers store only a SHA-256 hash of it, never the plaintext, and the token expires after 90 days. The CLI acts with your own identity and permissions, the same authorization checks and tenant isolation as the Dock web app, so it can do exactly what you can already do in Dock and nothing more. It is not an agent, carries no agent API key, and uses no MCP-as-agent path. Revoke it at any time from Dock Settings or by running dock logout on that machine.

Signing in

dock login

The CLI prints a short code and opens your browser to approve it. You approve as the human already signed in to Dock. Nothing is typed into the terminal, and the terminal never sees your password.

What you seebash
To sign in, open this URL and confirm the code:

  https://app.trydock.ai/cli/authorize?code=HJKL-4821

  code:  HJKL-4821

Waiting for approval in your browser...  (Ctrl-C to cancel)

Confirm afterwards with dock whoami, which prints the signed-in human, the org, and your role in it.

Revoking

dock logout revokes the credential on that machine. Each machine you sign in from holds its own, so signing out of one does not sign out the others. If you no longer have the machine to hand, revoke it from Dock Settings instead.

dock logout

Pointing at another environment

Set DOCK_URL. It defaults to https://app.trydock.ai. Each host holds its own credential, so signing in to one does not sign you in to another.

DOCK_URL=https://staging.trydock.ai dock login

Related: CLI reference · Install · First steps

Frequently asked questions

Does the Dock CLI sign in as me or as an agent?
As you, the signed-in human account holder. It acts with your own identity and permissions, the same authorization checks and tenant isolation as the Dock web app, so it can do exactly what you can already do in Dock and nothing more. It is not an agent, carries no agent API key, and uses no MCP-as-agent path.
Where is the Dock CLI credential stored?
In your operating system's keychain: macOS Keychain, Windows Credential Vault, or libsecret via keytar, on your own machine. Dock's servers store only a SHA-256 hash of it, never the plaintext.
Does the Dock CLI credential expire?
Yes, after 90 days. Run `dock login` again to get a fresh one.
How do I revoke Dock CLI access?
Run `dock logout` on that machine, or revoke it from Dock Settings. Each machine holds its own credential, so revoking one does not sign out the others.
Can I use the Dock CLI on a headless machine or in CI?
Signing in needs a browser to approve the request, so a fully headless box has nothing to approve with. There is no API-key fallback: the CLI is human-auth only by design, and a key-based path would hand a machine a capability the human model exists to avoid.
How do I point the Dock CLI at a different environment?
Set `DOCK_URL`. It defaults to https://app.trydock.ai. Each host holds its own credential, so signing in to one does not sign you in to another.
Updated