CoreLayer AI Security logoCoreLayer AI Security
DashboardQuickstart

Authentication

The CLI authenticates through your browser using the same identity as the dashboard. There is no separate password and no API key to paste.

Signing in

Terminal
secureai login

What happens:

  1. The CLI starts a temporary listener on 127.0.0.1 on a random high port and generates a PKCE verifier and challenge.
  2. Your browser opens to the control plane's authorisation page.
  3. You sign in as you normally would. Your organisation configures the identity provider, which handles the credentials.
  4. The browser redirects back to the loopback listener with a one-time code. The CLI exchanges it, with the PKCE verifier, for a session token.
  5. The session is written to ~/.secureai/credentials.json and the listener shuts down.

Why loopback and PKCE

The token never travels through a copy-paste step and never appears in your shell history or process list. The authorisation code is bound to a secret the CLI generated locally, so an intercepted code is useless on its own.

If the browser cannot open

On a headless machine the CLI prints the URL instead. Open it on any device, complete the sign-in, and the loopback callback still has to reach the machine running the CLI. So for remote servers, forward the port over SSH:

Terminal
ssh -L 54123:127.0.0.1:54123 user@remote-host

Checking who you are

Terminal
$ secureai whoami
  you@yourcompany.com
  Name    Your Name
  Role    developer
  Server  https://api.corelayersecurity.com

Your role comes from the control plane, not from anything local. Changing the file will not grant you more access. It determines which commands you can run and which payloads you can fetch.

Signing out

Terminal
secureai logout

This clears the stored credentials on this machine. For a session you no longer control, such as one on a lost laptop or former colleague's device, an org admin revokes it from CLI access in the dashboard.

Choosing the server

SourceExamplePrecedence
--server--server https://api.corelayersecurity.comHighest
SECUREAI_SERVERexport SECUREAI_SERVER=https://api.corelayersecurity.comUsed when the flag is absent
Defaulthttp://localhost:8080Fallback

What your role allows

Four roles exist in every organisation. The CLI enforces the same boundaries as the dashboard. For example, the adversarial payload corpus is available only to developers and security researchers.

RoleCLI access
Organisation AdminFull CLI access; also manages users, models, and CLI tokens in the dashboard.
Security ResearcherFull CLI access across all four phases.
DeveloperFull CLI access, scoped to the models and projects they are assigned.
ExecutiveNo CLI use in practice. This role is dashboard-only, for posture and compliance summaries.

The complete permission matrix is on Roles & permissions.

Authenticating in CI

Browser login is interactive and will not work on a build runner. Instead, an org admin issues a scoped CLI token from the dashboard and you expose it to the job as a secret.

GitHub Actions
- name: Scan prompts
  env:
    SECUREAI_SERVER: https://api.corelayersecurity.com
    SECUREAI_TOKEN: ${{ secrets.SECUREAI_TOKEN }}
  run: secureai scan ./prompts --fail-on high

Treat CLI tokens like deploy keys

A token carries the user, project, model, and environment scope it was issued with. Store it in your CI secret store, never in the repository, and rotate it from CLI access when someone leaves the team.

Troubleshooting

  • “not logged in: run `secureai login`”: no credentials file, or it was removed. Log in again.
  • “state mismatch on callback”: the browser returned a response from a different login attempt. Close stray tabs and retry.
  • The browser hangs on the callback: something else holds the loopback port, or a VPN is intercepting 127.0.0.1. Retry; the CLI picks a new port each time.
  • 401 on a command that worked yesterday: your session expired or was revoked. Run secureai login again.