Skip to content
NRNSNRNSNRNS Help

Authentication

nrn authenticates with a browser-based device flow — you never type a password into the terminal.

Logging in

Section titled “Logging in”

Run:

nrn auth login

This prints a short code and a URL, and opens the URL in your browser (pass --no-open to skip that and open it yourself — useful on a headless machine). In the browser, sign in to NRNS as usual if you aren’t already, then check that the code on the page matches the one in your terminal, pick which workspace(s) this login should be able to access, and select Approve. The terminal picks up the approval on its own — nrn auth login keeps polling until you approve, deny, or the request expires.

The Device name field on that page is prefilled from --label <name> (or your machine’s hostname if you didn’t pass one), so you can tell your devices apart later.

What gets access

Section titled “What gets access”

The grant you approve is scoped to the workspace(s) you selected while approving it — not your entire account. A CLI login for one workspace doesn’t need to see another workspace’s tasks. You can approve a grant for more than one workspace at once, and adjust which workspaces it covers later without logging in again.

Once logged in, most commands need to know which workspace and team to run against:

  • nrn workspace list — the workspaces this login can see.
  • nrn workspace use <name-or-id> — set the default workspace, so you don’t have to pass --workspace on every command.
  • nrn team use <KEY> — set the default team, so a bare task number like 42 resolves to ENG-42 instead of needing the full ref.

Both defaults are saved locally alongside your token and can be overridden per command with --workspace or --team.

Reviewing, editing, and revoking grants

Section titled “Reviewing, editing, and revoking grants”

Approvals happen on the page the login link opens in your browser. To review a grant afterward — see which workspaces it can reach, change that, or revoke it entirely — go to Settings → Connected accounts in the Tasks app. Every connected CLI or agent credential is listed there with when it was added and last used, an Edit workspaces button, and a Revoke button that disables it immediately.

Logging out

Section titled “Logging out”
nrn auth logout

removes the token from this machine only. The grant itself still exists until you revoke it from Settings → Connected accounts, so use that instead if you want to fully cut off a lost or compromised device.

Next steps

Section titled “Next steps”