# Sign in with the CLI (/docs/cli/sign-in)



## First-time setup [#first-time-setup]

Run:

```sh
ivk init
```

The CLI starts device authorization and opens the browser. Complete sign-in in the browser, then return to the terminal. If the account has no workspace, the CLI asks for a workspace name and creates it before saving the session.

To supply the first workspace name in the command:

```sh
ivk init --workspace-name "Acme reliability"
```

Use `--no-browser` when the CLI should print the authorization URL and code without opening a browser:

```sh
ivk login --no-browser
```

## Confirm the session [#confirm-the-session]

```sh
ivk whoami
ivk status
```

`whoami` shows the signed-in user, active workspace, role, and workspace ID. `status`, or `st`, shows current readiness and the next action.

## Work with several workspaces [#work-with-several-workspaces]

```sh
ivk workspaces list
ivk ws switch org_123
ivk whoami
```

Switch uses the organization ID shown by `ivk ws list`. It obtains a signed session for that organization before changing the active workspace.

## Local credential storage [#local-credential-storage]

Interactive sign-in stores the session in the operating system keychain. If the keychain is unavailable, the CLI uses a user-only credentials file with mode `0600` under the Invokeable configuration directory.

Production and staging credentials are isolated from each other.

## Sign out [#sign-out]

```sh
ivk logout
```

Logout removes the CLI session from the keychain or fallback file. It does not sign out the web application or remove workspace data.

## Short-lived automation tokens [#short-lived-automation-tokens]

Automation can provide a short-lived, workspace-bound token through `INVOKEABLE_ACCESS_TOKEN`. Do not store it in source control or print it in job logs. See [Automation](/docs/cli/automation).