Sign in

Syntic Code uses your Syntic account. You sign in once in the browser, and the CLI keeps you signed in after that by renewing its access in the background.

Any of these starts the same flow:

Where you are	Type
First launch of `syntic`	Pick Sign in on the welcome screen
A shell	`syntic login`, `syntic auth login` or `syntic --login`
Inside a session	`/login`

Your browser opens on syntic.ai. Log in with your account (Google or email), approve the request, and return to the terminal. The CLI picks up the result on its own; there is nothing to paste.

Behind the scenes this is an OAuth sign-in with PKCE that returns to a short-lived local address on your machine. The CLI never creates a long-lived API key for you: it holds a short-lived access token and a refresh token, and swaps them for fresh ones before they run out.

After you sign in, the CLI reads your plan from your account. Its name shows on the Plan: line of the welcome header. See Plans & models for what happens on a free or lapsed plan.

When the browser does not open

/login also prints the sign-in address. /login copy copies it, so you can open it in any browser on the same machine.

Signing in over SSH or on a headless machine

Set SYNTIC_NO_BROWSER=1 and run syntic auth login. No browser opens; the CLI shows the address and a paste flow: open the address on a computer with a browser, finish signing in, and paste back what the page gives you.

Check whether you are signed in

syntic auth status

logged in    : yes
auth method  : apiKey
api provider : api.syntic.ai

Add --json for one JSON object instead. The exit code is 0 when you are signed in and 1 when you are not, so scripts can gate on it:

syntic auth status >/dev/null || echo "run: syntic auth login"

Inside a session, /status shows your account, plan, model and session details, and /doctor shows where the credential came from and when it expires.

Sign out

syntic auth logout

or /logout inside a session. This removes the stored credentials. Running it when you are already signed out is not an error.

Method	How	Notes
Refresh token	Set `SYNTIC_OAUTH_REFRESH_TOKEN`	The CLI swaps it for an access token at start. No key is created.
Stored token	`syntic setup-token`, then paste the token	Reads the token from standard input or a hidden prompt, never from the command line, so it does not end up in `ps` output or shell history.
API key variable	Set `SYNTIC_API_KEY`	Wins over every other source.
Key helper	Set `apiKeyHelper` in your user settings to a command that prints a credential	Handy with a secrets manager. User settings only.

# CI example: read the token from your CI's secret store
export SYNTIC_OAUTH_REFRESH_TOKEN="$SYNTIC_TOKEN_FROM_CI"
syntic -p "run the linters and summarize what fails"

Credentials such as SYNTIC_API_KEY and SYNTIC_OAUTH_REFRESH_TOKEN are stripped from the environment of every command, hook and MCP server Syntic Code starts, so tools it runs cannot read them.

Which credential wins

When more than one is present, the CLI uses the first it finds:

SYNTIC_API_KEY
apiKey in your user settings (written by setup-token)
Your saved browser sign-in
The apiKeyHelper command

Where credentials are kept

Credentials live in your user folder (~/.syntic, or SYNTIC_CONFIG_DIR), readable only by your user account. Project settings files can never choose a credential or the API endpoint, so a repository you clone cannot redirect your sign-in.

Organization rules

An administrator can pin sign-in for every user on a machine through organization policy: forceLoginOrgUUID accepts only sign-ins to one organization.

See Install & sign-in troubleshooting.

Install and update How Syntic Code works