Authentication

Sign in from a machine with a browser

layer login

This opens your browser, signs you in with your Layer account, and stores the credential in your operating system keychain. The profile is pinned to the deployment you signed in to, so a later command cannot silently talk to a different one.

Sign in without a browser

Over SSH, inside a container, or on any machine that cannot open a browser:

layer login --device

The CLI prints a short code and a URL. Enter the code from any other device, and the terminal picks up the session once you have.

Sign in with a token

layer login --token pat_...

Useful when you want the token stored like a browser sign-in. For a run that must not touch stored credentials at all — CI, a render farm, a scheduled job — set the environment variable instead:

export LAYER_API_KEY=pat_...
layer generate image -p "..."

LAYER_API_KEY wins over anything stored, so a CI job never picks up a developer’s session. Create a token from Settings → Personal Access Tokens in the app; see authentication for the permission model.

Check and change who you are

layer whoami            # the account, workspace, and deployment in use
layer use my-studio     # choose the workspace subsequent commands act on
layer logout            # forget the stored credential

layer use takes a workspace name, slug, or id, and writes the choice to the active profile. To pin a directory rather than your whole shell, commit a layer.toml.

Caution

Exit code 3 means authentication: not signed in, the credential expired, or the token lacks access to what you asked for. A script can branch on it without parsing the message — see scripting.