Log in

Run:

sandscape login

The CLI prints a link and a short code, then waits. Open the link, sign in or create a Sandscape account, and approve the code. The CLI saves a scoped token on this computer after you approve it. It never prints the token.

You normally log in once per computer. Later commands reuse the saved token.

Check your login

Run this before starting a new login if you are unsure whether the computer is already authorized:

sandscape list --json

Exit code 0 and a JSON array mean you are logged in. Exit code 1 with a not_authorized error means you need to run sandscape login.

list --json is useful for this check because it does not open the interactive project picker.

Log out

sandscape logout

This removes the saved credentials from the current computer. To invalidate the token itself, revoke it in your Sandscape account settings.

Login from a coding agent

The login command waits until you approve it. A coding agent should run it in the background, read the first JSON event, and show you the approval link:

LOG="${TMPDIR:-/tmp}/sandscape-login.jsonl"
npx -y @sandscape/cli@latest login --json > "$LOG" 2>&1 &
LOGIN_PID=$!

The first line is a verification event:

{"event":"verification","verification_uri":"https://example/device","user_code":"ABCD-EFGH","verification_uri_complete":"https://example/device?code=ABCD-EFGH","expires_in":900,"interval":5}

Open verification_uri_complete. After you approve the code, the final event is:

{"event":"authorized","scopes":["cli"]}

The process exits with code 0 after authorization. It exits with code 1 and an error event if authorization fails.

Login errors

• If a command reports not_authorized, run sandscape login again. The saved token may be missing, expired, or revoked.
• If the approval code expires, run sandscape login again to get a new code. A code is valid for 900 seconds.