Login & Accounts

These commands manage browser-based authentication and the team your runs are billed to. They're the recommended way to authenticate for local or interactive use. For CI and headless environments, you should use an API key instead.

dcd login

Authenticate with DeviceCloud via your browser. Run it once and the CLI stores your session, so subsequent commands don't need an API key.

dcd login

This opens your browser to complete sign-in (email OTP or Enterprise SSO). After you authorise the CLI, if you belong to more than one team you'll be prompted to pick the one to use. The picker starts on the team from your last login, so pressing Enter keeps it. Your session is then saved locally (see Where credentials are stored).

Flags

Flag	Description
--no-browser	Print the login URL instead of opening a browser. Useful over SSH or on machines without a browser.
--frontend-url <url>	Override the frontend URL used to complete login
--org <name|id>	Use this team instead of picking one. Teams are matched by name (case-insensitive) or ID, and login fails if you're not a member.

INFO

dcd login uses a PKCE browser flow with no local server, so it works over SSH and when you open the URL on a different device. A leaked login URL is inert and can't be used to claim your session.

If you're already logged in, dcd login asks for confirmation before replacing the existing session.

Without a terminal

When dcd login runs where nobody can answer a prompt, such as in a script or a shell that an AI agent runs, it doesn't prompt:

• If you're already logged in, it replaces the session without asking. Your existing session stays until the new login completes.
• If you belong to more than one team, it uses --org if you pass it. Otherwise it uses the team from your last login to the same environment and prints which one it used.
• If there's no previous team (for example, after dcd logout), it exits with an error that lists your teams, so you can run it again with --org.

You still complete sign-in in a browser. Pass --no-browser to print the URL instead of opening it.

dcd logout

Clear the stored session and revoke it server-side (best effort).

dcd logout

This only affects the dcd login session and it does not touch the environment variables or the --api-key flag.

dcd whoami

Show the user and team of your stored dcd login session.

dcd whoami

Prints the logged-in user, the active team, and the environment. If you're not logged in, it prints a hint to run dcd login or set DEVICE_CLOUD_API_KEY.

INFO

dcd whoami only reads the stored session. If you also pass --api-key or export DEVICE_CLOUD_API_KEY, every other command uses that key — and the key's team — instead of the session shown here.

dcd switch-org

Switch the active team for your logged-in session. Useful if you belong to more than one team.

# Interactive picker
dcd switch-org

# Switch directly by team name
dcd switch-org "example@example.com's Team"

Teams are matched by name (case-insensitive). Without a terminal, such as in a script, pass the team name, because the picker needs a keypress. Requires an active dcd login session. It only changes the session's team: an exported DEVICE_CLOUD_API_KEY doesn't affect switch-org, but still takes precedence for every other command.

Where credentials are stored

The session from dcd login is written to:

• $DCD_CONFIG_DIR/config.json, if DCD_CONFIG_DIR is set, or
• $XDG_CONFIG_HOME/dcd/config.json, or
• ~/.dcd/config.json if XDG_CONFIG_HOME is not set

The file is created with 0600 permissions (owner read/write only) and holds your session tokens and the active team. When a command starts, the CLI refreshes the session if it's about to expire, so you should rarely need to log in again. A process that keeps running, such as the MCP server, doesn't refresh its session, so use an API key for long-running processes.