Sign in securely

You need a published UnlimGPT CLI, access to your UnlimGPT organization, a browser session, and an unlocked operating-system credential store. A separate login is optional when you use unlimgpt configure: that command starts browser authorization if needed.

Start authorization

Run:

unlimgpt login

The terminal shows a verification URL and a short user code. The browser page shows UnlimGPT CLI, the requested permissions, your organization, and the same code. Approve only the request you started. Keep the terminal open while it waits for the browser decision.

Before you approve

• Confirm that the code in the browser exactly matches the terminal.
• Reject a code you did not start yourself.
• Review the requested scopes; the CLI can read identity and manage your developer API keys, but it cannot act as a browser session.
• A pre-filled URL never approves access automatically.

For SSH or a machine without a desktop browser, use unlimgpt login --no-browser and open the displayed HTTPS URL yourself.

Check the result

After approval, the CLI confirms that you are signed in. Check the active user and organization without making a paid model request:

unlimgpt whoami --json

The response contains the account email in data.user.email and the organization ID in data.organization.id. Compare the ID with the organization selected in the browser. Plain unlimgpt whoami prints only the email.

If the account or organization is wrong, run unlimgpt logout and start authorization again with the intended browser account. If the code expires or you reject it, run unlimgpt login again to get a new code. If the browser does not open automatically, use the URL already printed in the terminal. If the credential store is locked or unavailable, unlock or configure it before retrying; the CLI does not save the refresh token in a plaintext file.

The access token stays in memory for a few minutes. The rotating refresh token is stored only in the operating-system credential store. unlimgpt logout revokes the authorization before deleting the local token; if revocation fails, the local token is kept so you can retry. See credential security for storage and recovery details.

Next, connect your first client and verify one real request there.