# Authentication

> Log in with browser auth or an API key, and understand how the CLI picks an app.

The Watasu CLI supports two ways to log in: a browser flow for humans and API keys for automation. Once authenticated, the same credentials work for both API calls and Git pushes to `git.watasu.io`.

## Browser login

```bash
watasu login
```

The CLI opens your browser, you authenticate, and it stores credentials locally. If the browser can't open (for example over SSH), the CLI prints the login URL so you can open it elsewhere. Use this on workstations.

## API key login

For CI, scripts, or any non-interactive environment:

```bash
watasu login --api-key "$WATASU_API_KEY"
```

Generate API keys in the dashboard. Keep them in your CI provider's secret store, not in your repo.

## Where credentials live

Credentials are stored in your `~/.netrc` file (`%USERPROFILE%\_netrc` on Windows) with user-only permissions, under entries for `api.watasu.io`, `git.watasu.io`, and `box.watasu.io`. That's why `git push` to your Watasu remote works without any extra setup after login — Git reads the same file — and why `watasu token` and [`watasu ssh`](https://docs.watasu.io/sandboxes/ssh.md) can authenticate sandbox SSH sessions with no extra prompts.

## Who am I logged in as?

```bash
watasu whoami
```

## Log out

```bash
watasu logout
```

Removes locally stored credentials.

## How the CLI chooses an app

Most commands target a single app. The CLI resolves which one in this order:

1. `--app <name>` if you passed it explicitly
2. `--remote <name>` if you specified a Git remote name
3. the default `watasu` Git remote in the current directory

That's why running `watasu config:set FOO=bar` works without `--app` when you're inside your app's repo — the remote tells the CLI which app to target.

## Tips

* On workstations, use browser login. It rotates cleanly with your account.
* In CI, use API keys. Treat them like any other deploy credential.
* When scripting, always pass `--app` explicitly. Implicit remote-based resolution is convenient interactively but a footgun in CI.

[View this page on the web](https://docs.watasu.io/cli/authentication/)