# Signing in

How the command line client signs a machine in to your organisation, and where it keeps that sign-in.


The command line client signs a machine in to one organisation at a time.

```bash
brewless login acme
```

`acme` is the name of your organisation, as in `acme.brewless.eu`.

## How it works

1. The client shows a code, like `ABCD-2345`, and a link, and tries to open the link in your browser.
2. In the console you check the code and approve the sign-in.
3. The client receives a token of its own for this machine.

Use `--no-browser` when the machine has no browser, and open the link on another device.

A sign-in has to be approved within 10 minutes. Starting one is limited to ten a minute per address, and sixty a minute for the organisation as a whole.

## The token

The token acts as you in that organisation. It works for 90 days and can be ended at any time on the **Account** page of the console.

It is kept on the machine in `~/.config/brewless/credentials.json`, readable by you only.

## In a pipeline

A pipeline does not sign in. It deploys with a pipeline token you make in the console and give it as `BREWLESS_API_TOKEN`. See [Deploying from a pipeline](/deployments/from-a-pipeline).

## Signing out

```bash
brewless logout acme
```

This forgets the sign-in on this machine.

## Settings

| Variable | Meaning | Default |
| --- | --- | --- |
| `BREWLESS_HOST` | The domain organisations live under | `brewless.eu` |
| `BREWLESS_HOME` | Where sign-ins are kept | `~/.config/brewless` |
| `BREWLESS_API_TOKEN` | A pipeline token, used instead of the sign-in of the machine | none |