# Authentication

## Sign in from a machine with a browser

```bash
layer login
```

This opens your browser, signs you in with your Layer account, and stores the credential in your operating system keychain. The profile is pinned to the deployment you signed in to, so a later command cannot silently talk to a different one.

## Sign in without a browser

Over SSH, inside a container, or on any machine that cannot open a browser:

```bash
layer login --device
```

The CLI prints a short code and a URL. Enter the code from any other device, and the terminal picks up the session once you have.

## Sign in with a token

```bash
layer login --token pat_...
```

Useful when you want the token stored like a browser sign-in. For a run that must not touch stored credentials at all — CI, a render farm, a scheduled job — set the environment variable instead:

```bash
export LAYER_API_KEY=pat_...
layer generate image -p "..."
```

`LAYER_API_KEY` wins over anything stored, so a CI job never picks up a developer’s session. Create a token from **Settings → Personal Access Tokens** in the app; see [authentication](/docs/authentication) for the permission model.

## Check and change who you are

```bash
layer whoami            # the account, workspace, and deployment in use
layer use my-studio     # choose the workspace subsequent commands act on
layer logout            # forget the stored credential
```

`layer use` takes a workspace name, slug, or id, and writes the choice to the active profile. To pin a directory rather than your whole shell, commit a [layer.toml](/docs/cli/configuration).

Caution

Exit code `3` means authentication: not signed in, the credential expired, or the token lacks access to what you asked for. A script can branch on it without parsing the message — see [scripting](/docs/cli/scripting).