> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/reference/commands/sign-in-and-contexts.md).

# Sign-in and context commands

Every option of devo login, logout, status, info, and the devo context commands, with defaults, allowed values, and the rules Devolutions CLI checks.

This page lists every argument and option of the commands that save, select, and inspect your workspaces: `devo login`, `devo logout`, `devo status`, `devo info`, and `devo context`. For an overview of all commands, see [Commands](/cli/reference/commands.md). For step-by-step help, see [Sign in to Devolutions Cloud](/cli/guides/connect/devolutions-cloud.md), [Sign in to Devolutions Server](/cli/guides/connect/devolutions-server.md), [Use a local Devolutions Remote Desktop Manager profile](/cli/guides/connect/local-profile.md) and [Switch between workspaces](/cli/guides/connect/switch-workspaces.md).

The options every command accepts, such as `--context`, `--source`, or `--output json`, are in [Global options](/cli/reference/global-options.md).

{% hint style="info" %}
A **context** is a saved workspace: a Devolutions Cloud sign-in, a Devolutions Server sign-in, or a local profile. Context names are compared without regard to case, so `Prod` and `prod` are the same context.
{% endhint %}

## devo login

Saves a workspace as a context: signs in to Devolutions Cloud or Devolutions Server, or points at the folder of a local Devolutions Remote Desktop Manager profile. The new context becomes the current one, unless you add `--no-set-current`.

**Workspace:** All workspace types

```bash
devo login <name> --cloud <url> --oauth
devo login <name> --cloud <url> --application-key <key> --application-secret-env <variable>
devo login <name> --server <url> --api-key-env <variable>
devo login <name> --server <url> --username <username> --password-env <variable>
devo login <name> --sqlite <folder>
```

Pass exactly one of `--cloud`, `--server`, or `--sqlite`. Without any of them, or with more than one, the command stops before contacting anything.

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;name></code></td><td></td><td>Name of the context to create. Required. It can't be empty. It can't be a name already used by a context of another kind: choose another name, or delete the other context first.</td></tr><tr><td><code>--cloud &#x3C;url></code></td><td></td><td>Devolutions Cloud address, for example <code>https://example.devolutions.app</code>. It must be an absolute <code>https</code> address without a username or password in it; plain <code>http</code> is accepted only for a loopback address such as <code>localhost</code>. Signing in again with the name of an existing Devolutions Cloud context replaces it.</td></tr><tr><td><code>--server &#x3C;url></code></td><td></td><td>Devolutions Server address. Same rules as <code>--cloud</code>: absolute <code>https</code> address, <code>http</code> only for a loopback address, no username or password in it.</td></tr><tr><td><code>--sqlite &#x3C;folder></code></td><td></td><td>Folder of the local Devolutions Remote Desktop Manager profile that holds the SQLite workspace. Environment variables in the path are expanded. Nothing is signed in: the context only points at the folder. The sign-in options below are ignored with <code>--sqlite</code>.</td></tr><tr><td><code>--oauth</code></td><td>Off</td><td>Devolutions Cloud or Devolutions Server: signs in through your browser. Devolutions CLI prints the sign-in address on the error output every time, in case the browser doesn't open. Uses a local browser redirect, unless you add <code>--use-device-code</code>. Can't be combined with the application key options (Devolutions Cloud), or with an API key, username, password, domain, or application-user option (Devolutions Server).</td></tr><tr><td><code>--use-device-code</code></td><td>Off</td><td>With <code>--oauth</code> only: signs in with a device code instead of the local browser redirect, for a computer without a browser. Setting the environment variable <code>DEVO_CLI_USE_DEVICE_CODE</code> has the same effect. With Devolutions Cloud, a device-code sign-in gets no account key, so only <code>devo status</code> and <code>devo logout</code> work: sign in without <code>--use-device-code</code> for full access. Refused without <code>--oauth</code>.</td></tr><tr><td><code>--application-key &#x3C;key></code> (<code>--app-key</code>)</td><td></td><td>Devolutions Cloud only: application key. Required for a Devolutions Cloud sign-in without <code>--oauth</code>. It can't contain control characters. Refused with <code>--oauth</code> and with <code>--server</code>.</td></tr><tr><td><code>--application-secret-env &#x3C;variable></code> (<code>--app-secret-env</code>)</td><td></td><td>Devolutions Cloud only: name of the environment variable that holds the application secret. Use this option or <code>--application-secret-file</code>, not both. The variable must exist and its value can't be empty.</td></tr><tr><td><code>--application-secret-file &#x3C;path></code> (<code>--app-secret-file</code>)</td><td></td><td>Devolutions Cloud only: file that holds the application secret. Line breaks at the end of the file are ignored.</td></tr><tr><td><code>--api-key-env &#x3C;variable></code></td><td></td><td>Devolutions Server only: name of the environment variable that holds the API key. Use this option or <code>--api-key-file</code>, not both. Can't be combined with <code>--username</code>, a password option, <code>--domain-id</code>, or <code>--as-application</code>.</td></tr><tr><td><code>--api-key-file &#x3C;path></code></td><td></td><td>Devolutions Server only: file that holds the API key.</td></tr><tr><td><code>--username &#x3C;username></code></td><td></td><td>Devolutions Server only: username, for username and password sign-in. Needs <code>--password-env</code> or <code>--password-file</code>.</td></tr><tr><td><code>--password-env &#x3C;variable></code></td><td></td><td>Devolutions Server only: name of the environment variable that holds the password. Use this option or <code>--password-file</code>, not both. Needs <code>--username</code>.</td></tr><tr><td><code>--password-file &#x3C;path></code></td><td></td><td>Devolutions Server only: file that holds the password. Needs <code>--username</code>.</td></tr><tr><td><code>--windows-auth</code></td><td>Off</td><td>Devolutions Server only: signs in with Windows authentication. Works on Windows only. Can't be combined with <code>--username</code>, a password option, <code>--domain-id</code>, or <code>--as-application</code>.</td></tr><tr><td><code>--as-application</code></td><td>Off</td><td>Devolutions Server only: with <code>--username</code> and a password option, signs in as an application user.</td></tr><tr><td><code>--domain-id &#x3C;id></code></td><td></td><td>Devolutions Server only: domain ID, for domain authentication with <code>--username</code> and a password option.</td></tr><tr><td><code>--timeout &#x3C;seconds></code></td><td><code>15</code></td><td>Devolutions Cloud and Devolutions Server: timeout of the requests made while signing in, from 3 to 600 seconds. Any other value is refused. The value isn't saved with the context: it applies to this sign-in only.</td></tr><tr><td><code>--no-set-current</code></td><td>Off</td><td>Saves the context without making it the current one. For a local profile, the new context still becomes the current one when no context is current yet.</td></tr><tr><td><code>--workspace &#x3C;name></code></td><td></td><td>Local profile only: default workspace, saved with the context as a hint for people and agents. Refused with <code>--cloud</code> or <code>--server</code>.</td></tr><tr><td><code>--vault &#x3C;name></code></td><td></td><td>Local profile only: default vault, saved with the context as a hint for people and agents. Refused with <code>--cloud</code> or <code>--server</code>.</td></tr><tr><td><code>--description &#x3C;text></code></td><td></td><td>Local profile only: description of the context. Refused with <code>--cloud</code> or <code>--server</code>.</td></tr><tr><td><code>--replace</code></td><td>Off</td><td>Local profile only: replaces an existing local profile context with the same name. Without it, that name is refused. Refused with <code>--cloud</code> or <code>--server</code>.</td></tr></tbody></table>

### Sign-in methods at a glance

<table><thead><tr><th width="220">WORKSPACE</th><th>CHOOSE EXACTLY ONE OF</th></tr></thead><tbody><tr><td>Devolutions Cloud</td><td><code>--oauth</code> (optionally with <code>--use-device-code</code>), or <code>--application-key</code> with <code>--application-secret-env</code> or <code>--application-secret-file</code>.</td></tr><tr><td>Devolutions Server</td><td><code>--oauth</code> (optionally with <code>--use-device-code</code>), <code>--api-key-env</code> or <code>--api-key-file</code>, <code>--username</code> with <code>--password-env</code> or <code>--password-file</code> (optionally with <code>--domain-id</code> or <code>--as-application</code>), or <code>--windows-auth</code>. Without a sign-in method, or with more than one, the command stops.</td></tr><tr><td>Local profile</td><td>No sign-in: <code>--sqlite &#x3C;folder></code>, optionally with <code>--workspace</code>, <code>--vault</code>, <code>--description</code>, and <code>--replace</code>.</td></tr></tbody></table>

{% hint style="info" %}
Devolutions CLI doesn't save application secrets, API keys, or passwords. It saves the name of the environment variable or the path of the file, and reads the value again each time a command needs it. Keep that variable set, or that file in place, for as long as you use the context. A browser sign-in is kept in your operating system's secure store.
{% endhint %}

Before it saves a Devolutions Cloud or Devolutions Server context, `devo login` checks the sign-in with the workspace. If the check fails, nothing is saved. Errors in the options themselves stop the command with exit code `2`; a failed sign-in exits with `1`. See [Exit codes and errors](/cli/reference/exit-codes-and-errors.md).

## devo logout

Clears the stored sign-in of a Devolutions Cloud or Devolutions Server context. The context itself is kept: sign in again with `devo login`, or delete it with `devo context delete`.

**Workspace:** Devolutions Cloud, Devolutions Server

```bash
devo logout [<name>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;name></code></td><td>Current context</td><td>Context to sign out of. Without it, the current context is used; if no context is current, the command stops and asks for a name. A local profile context is refused, because it has no sign-in. For a browser sign-in, the session kept in the secure store is deleted too.</td></tr></tbody></table>

## devo status

Shows the selected workspace: its context, its kind, and, for Devolutions Cloud or Devolutions Server, whether you're signed in.

**Workspace:** All workspace types

```bash
devo status [<name>] [--online]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;name></code></td><td>Selected workspace</td><td>Context to show. Without it, the workspace selected by <code>--source</code>, <code>--context</code>, or the current context is shown. An unknown name is an error. For a local profile, the status shows the context and its profile folder. With <code>--source cloud</code> or <code>--source server</code> and no context name, the current context of that kind is used; if there's none, the status says you're not signed in instead of failing.</td></tr><tr><td><code>--online</code></td><td>Off</td><td>Devolutions Cloud and Devolutions Server: contacts the workspace to check that the sign-in still works. If the check fails, the command reports the error and exits with code <code>1</code>. Without <code>--online</code>, the status comes from what's saved on your computer and nothing is contacted. Has no effect on a local profile.</td></tr></tbody></table>

## devo info

Shows information about a Devolutions Cloud or Devolutions Server instance, for a saved context or for an address, without signing in.

**Workspace:** Devolutions Cloud, Devolutions Server

```bash
devo info [<name>]
devo info --cloud <url>
devo info --server <url>
devo info <name> --private
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;name></code></td><td>Selected workspace</td><td>Context to query. Without it and without an address, the selected workspace is used. A local profile is refused: the command works with Devolutions Cloud and Devolutions Server only. Can't be combined with <code>--cloud</code> or <code>--server</code>. With a saved context and without <code>--private</code>, only public information is returned and the context's sign-in isn't used.</td></tr><tr><td><code>--cloud &#x3C;url></code></td><td></td><td>Devolutions Cloud address to query without a saved context. Same address rules as <code>devo login</code>. Can't be combined with <code>--server</code> or a context name.</td></tr><tr><td><code>--server &#x3C;url></code></td><td></td><td>Devolutions Server address to query without a saved context. Only public information is returned. Can't be combined with <code>--cloud</code> or a context name.</td></tr><tr><td><code>--private</code></td><td>Off</td><td>Devolutions Server only: adds private information, using the sign-in of a saved context. Refused with <code>--server &#x3C;url></code>, and refused for Devolutions Cloud.</td></tr></tbody></table>

## devo context list

Lists your contexts of every workspace type, sorted by name, and shows which one is current. Alias: `devo context ls`.

**Workspace:** All workspace types

```bash
devo context list
```

This command has no arguments or options of its own.

## devo context use

Makes a context the current one. Every later command uses it, until you choose another one or override it for one command with the global option `--context <name>`.

**Workspace:** All workspace types

```bash
devo context use <name>
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;name></code></td><td></td><td>Context to make current. Required. If the same name exists for more than one kind of context, the command stops and tells you to delete one of them with <code>devo context delete &#x3C;name> --kind &#x3C;kind></code>.</td></tr></tbody></table>

## devo context inspect

Shows the details of a context: its kind, its address or profile folder, and, for a local profile, its default workspace, default vault, and description.

**Workspace:** All workspace types

```bash
devo context inspect [<name>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;name></code></td><td>Current context</td><td>Context to show. Without it, the current context is shown; if no context is current, the command stops and asks for a name.</td></tr></tbody></table>

## devo context delete

Removes a context. Alias: `devo context rm`. If it was the current context, no context is current afterwards.

**Workspace:** All workspace types

```bash
devo context delete <name> [--kind <kind>] [--yes]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;name></code></td><td></td><td>Context to delete. Required. Deleting a local profile context removes only the context: the profile folder isn't touched.</td></tr><tr><td><code>--kind &#x3C;kind></code></td><td></td><td>Kind of context to delete, when the same name exists for more than one kind: <code>sqlite</code> (local profile), <code>cloud</code>, or <code>server</code>. Any other value is refused.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms deleting a Devolutions Cloud or Devolutions Server context, which also discards its stored sign-in. Without it, such a context isn't deleted. Not needed for a local profile context.</td></tr></tbody></table>

## Next

* [Secret commands](/cli/reference/commands/secrets.md)
* [MCP, background process, and configuration commands](/cli/reference/commands/mcp-daemon-config.md)
* [Global options](/cli/reference/global-options.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/reference/commands/sign-in-and-contexts.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.