> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trytalkvalue.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Sign in interactively in the browser or use an API token in CI. Manage multiple organizations with profiles.

The TalkValue CLI supports two authentication paths so the same binary works on your laptop and in automation. Profiles let one install hold credentials for multiple workspaces or accounts.

## Interactive: local desktop

Sign in through the browser:

```bash theme={null}
talkvalue auth login
```

The CLI prints a one-time code, opens your default browser to the verification page, and waits for you to approve the device. Once you do, it polls for the access token, lists your organizations, and asks which one to use. Pick from the menu and the CLI saves a profile.

Skip the org picker by passing the name or ID up front:

```bash theme={null}
talkvalue auth login --org "Acme Inc."
talkvalue auth login --org org_01HXXX...
```

The access token is stored in your system keyring (Keychain on macOS, libsecret on Linux, Credential Manager on Windows). The profile record on disk holds the organization ID, organization name, your email, and the auth method, never the token itself.

## CI and scripting: API token

For non-interactive environments, set `TALKVALUE_TOKEN` and skip `auth login` entirely:

```bash theme={null}
export TALKVALUE_TOKEN=<your-token>
talkvalue path person list --json
```

An API token in the environment takes precedence over any saved profile, so the same shell can switch between accounts by re-exporting the variable. Generate the token from the dashboard's Settings area before adding it to your CI secret store.

## Multi-profile workflow

Each profile stores the organization ID, organization name, your email, and the auth method (`oauth` or token-based). Profiles let you keep credentials for a staging workspace and a production workspace on the same machine, or work across multiple customer organizations.

| Command                       | Description                                            |
| ----------------------------- | ------------------------------------------------------ |
| `talkvalue auth login`        | Sign in through the browser and select an organization |
| `talkvalue auth status`       | Show the active profile, email, and organization       |
| `talkvalue auth switch [org]` | Switch the active organization                         |
| `talkvalue auth list`         | List every saved profile                               |
| `talkvalue auth logout`       | Remove a profile and its stored credentials            |

Target a specific profile for a single command:

```bash theme={null}
talkvalue path person list --profile staging
```

Make a profile the default for the shell:

```bash theme={null}
export TALKVALUE_PROFILE=staging
talkvalue path person list
```

## Credential precedence

The CLI resolves credentials in this order:

| Priority | Source        | Set via                                |
| -------- | ------------- | -------------------------------------- |
| 1        | API token     | `TALKVALUE_TOKEN` environment variable |
| 2        | Saved profile | `talkvalue auth login`                 |

The `--profile <name>` flag and `TALKVALUE_PROFILE` env var only pick which saved profile is read at priority 2. A `TALKVALUE_TOKEN` in the environment still wins.

## Sign out

```bash theme={null}
talkvalue auth logout
```

Removes the active profile and clears its tokens from your system keyring. Pass `--profile <name>` to remove a specific profile.

## Related

* [Quickstart](/cli/quickstart). Install, sign in, run your first command.
* [Environment variables](/cli/environment-variables). Full env reference including `TALKVALUE_TOKEN`.
* [Global flags](/cli/global-flags). `--profile`, `--api-url`, and the rest.
* [Output format](/cli/output-format). Error envelope when auth fails.