> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rye.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Sign in with OAuth device-code auth and understand local credential storage.

Rye uses OAuth 2.0 Device Authorization Grant with PKCE for CLI login.

This flow works well for terminal tools because the CLI can print a browser link instead of asking for a password or browser session inside the terminal.

## Sign in

```bash theme={null}
rye auth login
```

Rye prints a link and waits while you complete login in the browser. After approval, the CLI stores tokens locally and notifies the daemon.

You can check auth state at any time:

```bash theme={null}
rye auth status
```

## How login works

```txt theme={null}
rye auth login
  -> request device code from the Auth API
  -> print a verification URL
  -> poll the token endpoint
  -> store access and refresh tokens
  -> save non-sensitive login metadata
  -> notify ryed that auth changed
```

Production auth uses fixed Rye endpoints:

* Auth API: `https://api.rye.ai`
* Auth UI: `https://auth.rye.ai`

Production builds reject auth URL overrides. Development builds can use Rye-owned development domains.

## Credential storage

Rye stores sensitive tokens in the OS credential store:

| Platform | Token storage              | Metadata storage                                                            |
| -------- | -------------------------- | --------------------------------------------------------------------------- |
| macOS    | Keychain                   | `~/Library/Application Support/rye/credentials.json`                        |
| Linux    | Secret Service             | `$XDG_CONFIG_HOME/rye/credentials.json` or `~/.config/rye/credentials.json` |
| Windows  | Windows Credential Manager | `%APPDATA%\rye\credentials.json`                                            |

Metadata can include non-sensitive fields such as the user email and last login time.

## Auth enforcement

`rye up` requires a valid login. If credentials are missing, Rye starts the device-code flow before starting the proxy.

The daemon also validates local auth state before it starts the proxy. This prevents a user from bypassing login by launching `ryed` directly.

## Sign out

```bash theme={null}
rye auth logout
```

Logout best-effort revokes tokens, clears local token storage, clears metadata, and tells the daemon that auth changed.