> ## Documentation Index
> Fetch the complete documentation index at: https://unkey.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# login

> Authenticate the Unkey CLI by storing your root key in a local configuration file. Run this command once to enable all CLI operations.

Authenticate the CLI by storing your root key locally.

Use this before running other commands so you don't need to pass `--root-key` every time. The command prompts for your root key interactively (input is hidden) and saves it to `~/.unkey/config.toml` with restricted file permissions.

You can create a root key from the [Unkey dashboard](/platform/root-keys/overview).

<Note>
  Your root key is stored in plaintext at `~/.unkey/config.toml`. Make sure only your user account can read this file. The CLI creates it with `0600` permissions by default.
</Note>

## Usage

```bash theme={"theme":"kanagawa-wave"}
unkey auth login
```

The command prompts you to enter your root key. Input is hidden for security:

```text theme={"theme":"kanagawa-wave"}
Enter your root key: ••••••••••••
Authentication successful. Key stored in /home/you/.unkey/config.toml
```

Once stored, all subsequent commands use this key automatically:

```bash theme={"theme":"kanagawa-wave"}
# No --root-key needed
unkey api keys create-key --api-id=api_1234abcd --name="My Key"
```

## Overriding the stored key

You can override the stored key on a per-command basis using the `--root-key` flag or the `UNKEY_ROOT_KEY` environment variable:

```bash theme={"theme":"kanagawa-wave"}
# Flag takes highest priority
unkey api apis get-api --api-id=api_1234abcd --root-key=unkey_xxx

# Environment variable
export UNKEY_ROOT_KEY=unkey_xxx
unkey api apis get-api --api-id=api_1234abcd
```

The priority order is: `--root-key` flag > `UNKEY_ROOT_KEY` env var > `~/.unkey/config.toml`.

## Updating your key

Run `unkey auth login` again to replace the stored key. The new key overwrites the previous one.