Authentication

pro

Linking a machine to your grith.ai account with browser device auth or an API key, and where the credentials land.

Pro

One command links a machine to your account and installs its licence:

terminal

$ grith pro login

Browser device auth (the default)

grith pro login with no flags runs a device-authorisation flow against api.grith.ai. It prints a verification URL - https://grith.ai/device - and an eight-character code with a dash in the middle, opens your browser, and polls every five seconds while you sign in and enter the code. The code is valid for ten minutes; if it lapses, run the command again for a new one.

Three things can come back other than success:

Pending - you have not finished in the browser yet. grith keeps polling.
Expired - the code timed out. Run grith pro login again.
No active licence - the sign-in worked but the team has no plan. grith prints the pricing URL and stops. Start a plan or a trial, then run grith pro login again.

API key (headless)

For a machine with no browser - a CI runner, a container, a remote box:

terminal

$ grith pro login --api-key <KEY>

Generate the key from Settings in the grith.ai dashboard. It is the same credential the device flow ends up storing, so both paths land in the same place.

⚠️The API key is the decryption key for synced provider keys

Team provider keys are encrypted at rest on this machine under a key derived from your account API key. Rotating the API key makes the existing envelopes undecryptable - re-run grith pro sync after a rotation. See Encrypted key management.

Where credentials live

File	Contents
`~/.config/grith/credentials.json`	Account and team id, API key, licence path, last validation and sync timestamps. Mode `0600`.
`~/.config/grith/license.key`	The signed licence itself. Mode `0600`.

One account per machine. There is no team switcher and no second credential slot - logging in again replaces what is there.

Checking state

terminal

$ grith pro status
Not logged in.
Run: grith pro login
     or: grith pro login --api-key <key>

Once signed in, grith pro status prints the plan and tier, the account email, team and seat count, the renewal date with days remaining, the billing portal URL, when the licence was last validated, and - if a daemon is running - the next scheduled refresh and the last refresh failure. See Licence lifecycle.

A running daemon re-gates immediately

login, activate, refresh, start-trial and logout signal a running daemon to re-read the licence file and re-apply the gate at once, with no network call. The concurrent-session cap and the gated features change on the spot rather than waiting for the daemon's next refresh. With no daemon running, the new tier applies at the next daemon start.

Logging out

terminal

$ grith pro logout
Logged out. Pro features disabled.

This deletes credentials.json and license.key. Anything already pulled to disk - team policies, shared configs, provider-key envelopes, the analytics device registration - is left in place; the provider-key envelopes are no longer decryptable without the API key.

Authentication

Browser device auth (the default)

API key (headless)

Where credentials live

Checking state

A running daemon re-gates immediately

Logging out

See also