login

Signing in opens the console in a browser and waits. Approving there hands the token to a listener on this machine, so nothing is copied, pasted, or left in a terminal's history. Where there is no browser, the same command prints the address and reads a token you paste.

A token belongs to one team, and signing in again adds a credential rather than replacing one. In a pipeline, do not sign in at all: set OUTPLANE_TOKEN and every command uses it.

login

Sign in to a team.

Usage

outplane login [flags]

Flags

This command does not accept --team. Every other global flag applies.

Output

Examples

Sign in, choosing the team in the console

outplane login

Sign in without a browser, on a remote machine

outplane login --no-browser

Sign in from a script, keeping the token out of argv

cat token.txt | outplane login --token-stdin

Sign in and confirm which team is active

outplane login --json --fields team,expiresAt

{
  "expiresAt": "2026-09-01T13:58:47Z",
  "team": "acme"
}

What to Know

• On a machine with a browser this opens one and waits: the console posts the token to a listener on 127.0.0.1, so nothing is copied and nothing reaches the screen. A port that will not open, a browser that never answers within three minutes, or --no-browser all fall back to reading a pasted token, and none of them is an error.
• The listener accepts one delivery, only from 127.0.0.1, and only when it carries back the one-time value this process generated.
• In CI, do not sign in. Set OUTPLANE_TOKEN and every command will use it; the token names its own team.
• A token belongs to one team. Signing in again adds a second credential rather than replacing the first.
• The console shows a token once, when it is created. It cannot be retrieved afterwards, only revoked and replaced.
• There is no team flag: the team is chosen in the console.
• No request is made, so a revoked token is stored without complaint and fails on the first command that uses it. Malformed input is still rejected here.

Errors

Beyond 0 for success, this command exits with:

The code on the error object is one of auth.no_terminal, auth.token_missing, auth.token_malformed, auth.token_pre_slug. Branch on that, or on the exit status. The message is prose and changes.

logout

Remove a stored credential.

Usage

outplane logout [flags]

Flags

The global flags apply as well.

Output

Examples

Sign out of the active team

outplane logout

Sign out of one team, keeping the others

outplane logout --team acme

Remove every stored credential from this machine

outplane logout --all

Sign out and confirm it in a script

outplane logout --json --fields team,signedOut

What to Know

• This removes the local copy only. The token stays valid until it is revoked in the console, so a leaked token needs revoking, not logging out.

Errors

Beyond 0 for success, this command exits with:

Related