Before deploying or managing sites, authenticate the leaf CLI with your LeafCloud account.

Interactive login (Browser)

Run leaf login:

leaf login

The CLI requests a device authorization code and opens your default browser automatically:

Open this URL in your browser: https://leafcloud.in/device?code=ABCD-EFGH
Your code: ABCD-EFGH
Waiting for approval…
Logged in successfully.

1. If your browser does not open automatically, copy and open the URL displayed in your terminal.
2. Verify that the 8-character confirmation code in your browser matches the terminal code.
3. Confirm access in your browser.
4. The CLI detects your approval and saves your access token to ~/.config/leaf/credentials.json with restricted file permissions (0600).

Verify active session

Confirm that your session is active by running:

leaf whoami

Output:

alex@example.com

With --json, the command outputs the user account details:

leaf whoami --json

{
  "schema": 1,
  "user": {
    "email": "alex@example.com",
    "access": "active",
    "id": "usr_942e4f01"
  }
}

Non-interactive authentication (CI and scripts)

For headless servers, CI pipelines, and automation where opening a browser is not possible, authenticate by setting the LEAF_TOKEN environment variable:

export LEAF_TOKEN="leaf_pat_your_token_here"

When LEAF_TOKEN is set, leaf bypasses the local credentials file and uses the provided token for all commands. You can create tokens with scoped permissions using leaf keys create.