Authentication

Rye uses OAuth 2.0 Device Authorization Grant with PKCE for CLI login. This flow works well for terminal tools because the CLI can print a browser link instead of asking for a password or browser session inside the terminal.

rye auth login

Rye prints a link and waits while you complete login in the browser. After approval, the CLI stores tokens locally and notifies the daemon. You can check auth state at any time:

rye auth status

rye auth login
  -> request device code from the Auth API
  -> print a verification URL
  -> poll the token endpoint
  -> store access and refresh tokens
  -> save non-sensitive login metadata
  -> notify ryed that auth changed

Production auth uses fixed Rye endpoints:

Auth API: https://api.rye.ai
Auth UI: https://auth.rye.ai

Production builds reject auth URL overrides. Development builds can use Rye-owned development domains.

Credential storage

Rye stores sensitive tokens in the OS credential store:

Platform	Token storage	Metadata storage
macOS	Keychain	`~/Library/Application Support/rye/credentials.json`
Linux	Secret Service	`$XDG_CONFIG_HOME/rye/credentials.json` or `~/.config/rye/credentials.json`
Windows	Windows Credential Manager	`%APPDATA%\rye\credentials.json`

Metadata can include non-sensitive fields such as the user email and last login time.

Auth enforcement

rye up requires a valid login. If credentials are missing, Rye starts the device-code flow before starting the proxy. The daemon also validates local auth state before it starts the proxy. This prevents a user from bypassing login by launching ryed directly.

Sign out

rye auth logout

Logout best-effort revokes tokens, clears local token storage, clears metadata, and tells the daemon that auth changed.

Start here

Core concepts

Configure Rye

Operate

Authentication

Credential storage

Auth enforcement

Sign out

​Sign in

​How login works

​Credential storage

​Auth enforcement

​Sign out

Sign in

How login works

Credential storage

Auth enforcement

Sign out