> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/guides/connect/devolutions-cloud.md).

# Sign in to Devolutions Cloud

Sign in to Devolutions Cloud from Devolutions CLI with your browser, or with an application key and secret for scripts and pipelines.

Sign in once and Devolutions CLI saves your Devolutions Cloud as a context, so every later command uses it without asking again. Use your browser when you work at your computer, and an application key when a script or a pipeline signs in for you.

You need the address of your Devolutions Cloud, for example `https://<your-organization>.devolutions.app`. Use an `https` address.

## Pick the right option

<table><thead><tr><th width="230">CHOOSE</th><th>WHAT HAPPENS</th><th>USE IT WHEN</th></tr></thead><tbody><tr><td><strong>Browser sign-in</strong> (<code>--oauth</code>)</td><td>Your browser opens on Devolutions Account. Devolutions CLI keeps the session in your operating system's secure store and renews it on its own.</td><td>You work at your own computer.</td></tr><tr><td><strong>Application key</strong> (<code>--application-key</code>)</td><td>Devolutions CLI signs in with an application key and its secret. The secret is read from an environment variable or a file, never typed on the command line.</td><td>A script, a scheduled task, or a CI pipeline signs in without anyone present.</td></tr></tbody></table>

## Sign in with your browser

1. Run `devo login` with a context name of your choice:

   ```bash
   devo login <context-name> --cloud https://<your-organization>.devolutions.app --oauth
   ```
2. Your browser opens. Sign in to your Devolutions account. If the browser doesn't open, or opens in the background, copy the address shown in the terminal into a browser.

The terminal confirms the sign-in, and the new context becomes the current one.

{% hint style="warning" %}
`--use-device-code` lets you sign in from another device, for example on a remote computer without a browser. But a device-code sign-in to Devolutions Cloud doesn't receive the key that opens your vault data: you can only check its status and sign out. To work with vaults and secrets, sign in with the browser on the same computer, or use an application key.

The `DEVO_CLI_USE_DEVICE_CODE` environment variable has the same effect: when it's set to any value other than empty, `0`, or `false`, every `--oauth` sign-in uses a device code, even without `--use-device-code`. Clear it before you sign in to Devolutions Cloud with the browser.
{% endhint %}

## Sign in with an application key

1. Put the application secret in an environment variable or a file that only you can read. Don't type it on the command line.
2. Run `devo login` with the application key and the name of the variable, or the path of the file:

{% tabs %}
{% tab title="Environment variable" %}

```bash
devo login <context-name> --cloud https://<your-organization>.devolutions.app --application-key <application-key> --application-secret-env <VARIABLE_NAME>
```

{% endtab %}

{% tab title="File" %}

```bash
devo login <context-name> --cloud https://<your-organization>.devolutions.app --application-key <application-key> --application-secret-file <path-to-file>
```

{% endtab %}
{% endtabs %}

Devolutions CLI checks the key and the secret with your Devolutions Cloud before it saves the context.

{% hint style="info" %}
Devolutions CLI doesn't save the application secret. It saves the name of the variable or the path of the file, and reads the secret again each time a command needs it. Keep that variable set, or that file in place, for as long as you use the context.
{% endhint %}

For pipelines, see [Sign in from a CI pipeline](/cli/for-devops-and-administrators/automate/ci-sign-in.md).

## Check and end the session

* `devo status` shows the current context and whether it has a sign-in. Add `--online` to contact Devolutions Cloud and confirm that the sign-in still works.
* `devo logout` clears the sign-in of the current context, or of the context you name. The context stays, so you can sign in again with the same name.
* `devo context delete <context-name> --yes` removes the context and its stored session.

## Good to know

* `--timeout` sets how long, in seconds, Devolutions CLI waits for each sign-in request: from `3` to `600`, `15` by default.
* `--no-set-current` saves the context without making it the current one. If no Devolutions Cloud context is current yet, it still becomes the one that `--source cloud` uses.
* A context name can be used by one workspace type only. If the name already exists for a local profile or a Devolutions Server, choose another name or delete the other context first.
* Browser sign-in needs your operating system's secure store. See [What data Devolutions CLI sends](/cli/guides/understand/privacy.md).
* Sign-in fails or the session expired? See [Sign-in fails or the session expired](/cli/help/troubleshooting/sign-in-fails.md).

## Next

* [Find the reference to a secret](/cli/guides/secrets/find-a-reference.md)
* [Switch between workspaces](/cli/guides/connect/switch-workspaces.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/guides/connect/devolutions-cloud.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.