Account & keys

Codewhale holds two unrelated kinds of credential, and it helps to keep them apart. A provider key lets a model answer. A Codewhale account is optional and gates the managed surfaces — cloud agents and chat channels. Installing and running the local runtime needs neither an account nor a key.

Provider key (BYOK)

Your own key for DeepSeek, OpenAI, Anthropic, OpenRouter, a local runtime, or any other route. Set with codewhale auth set --provider <provider>. Required for model replies.

Codewhale account

A browser device-flow session started by codewhale login. Optional. Gates cloud agents and the Codewhale Agent surfaces; never required locally.

Provider keys

codewhale auth set --provider <provider> saves the key for one provider. A process-level --api-key still wins for a single run. codewhale login is not a provider-key command: provider credentials are configured exclusively through codewhale auth set --provider <provider>.

codewhale auth set --provider deepseek
codewhale --model deepseek-v4-flash

The account session

codewhale login is the same browser device flow as codewhale account login. The session is scoped to the selected --profile, and the older codewhale cloud … spelling remains an alias.

codewhale login

Sign in through the browser device flow.

codewhale account status

Show the session for the selected profile.

codewhale account logout

Remove that session.

Where sessions live

Account sessions prefer the operating system's credential manager and fall back automatically to the private, 0600 Codewhale secrets file when no credential manager is available — headless hosts, SSH, containers. The former CODEWHALE_CLOUD_ALLOW_FILE_SESSION_STORE opt-in is deprecated and ignored.

The account's own key vault

codewhale account keys list|set|remove manages the signed-in account's bring-your-own-key vault without ever displaying a secret value.

Moving to another machine

codewhale config export --portable writes a secret-free bundle: credential and machine-specific keys are dropped, never replaced with a redacted placeholder, so the file is safe to carry and nothing in it can sign in as you.

Sign in on the web

The hosted Codewhale app carries the same account. Sign in or register there; the local runtime keeps working without it.