Authenticate the CLI with your nself.org account. Opens a browser-based OAuth flow, saves the session token to ~/.nself/auth.json, and refreshes existing tokens automatically.
# Log in interactively (opens browser)
nself login
# Log in headlessly — print the URL, don't open the browser
nself login --no-browsernself login [FLAGS]nself login is the shorthand alias for nself account login. It starts the OAuth 2.0 PKCE flow against nself.org/auth/cli. A local HTTP listener on a random port captures the callback, exchanges the authorization code for a session token, and writes the token to~/.nself/auth.json.
If a valid unexpired token already exists, login refreshes it silently and exits. If the token is expired or missing, the full browser flow is triggered.
In environments without a browser (SSH, CI, Docker), use --no-browser. The CLI prints the authorization URL; open it in any browser, complete the login, and the CLI resumes automatically via the callback listener.
The session token is scoped to the CLI. It is separate from any browser session you have atnself.org. You can be logged in to the CLI on multiple machines simultaneously.
| Flag | Type | Default | Description |
|---|---|---|---|
--no-browser | bool | false | Print the auth URL instead of opening the browser |
--timeout | int | 120 | Seconds to wait for the browser OAuth callback |
--force | bool | false | Force a new login even if a valid token exists |
--json | bool | false | Emit the resulting session info as JSON on success |
nself login
# Opening https://nself.org/auth/cli?state=... in your browser
# Waiting for callback...
# Logged in as aric@example.com (ɳSelf+)nself login --no-browser
# Open this URL in any browser to continue:
# https://nself.org/auth/cli?state=abcdef...
# Waiting for callback (120s)...# In CI: set NSELF_AUTH_TOKEN from a secret, skip interactive login entirely
export NSELF_AUTH_TOKEN=$NSELF_AUTH_TOKEN_CI
nself license validate # token is used automaticallynself login --force
# Clears cached token and starts a fresh OAuth flownself login --json | jq '.email, .plan'~/.nself/auth.json (mode 0600, readable by owner only)NSELF_AUTH_TOKEN — provide the session token directly, bypassing disk (useful in CI)NSELF_API_BASE — override the auth endpoint base URL (default: https://nself.org)NSELF_LOGIN_TIMEOUT — override the callback wait timeout in seconds0 — logged in successfully1 — OAuth flow failed or was denied2 — invalid arguments3 — timeout waiting for browser callback4 — network error reaching nself.org