> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tinycloud.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Set up a profile and sign in with OpenKey or a local key

Use this page when you need a TinyCloud profile, a session, or a headless auth path for automation.

## Pick a method

<CardGroup cols={2}>
  <Card title="OpenKey" icon="key">
    Browser-based sign-in. Best for interactive use.
  </Card>

  <Card title="Local key" icon="cpu">
    Private-key sign-in. Best for CI, agents, and other headless workflows.
  </Card>
</CardGroup>

## Start with a profile

`tc init` creates a profile directory, generates a keypair, and can optionally sign in immediately.

```bash theme={null}
tc init --name my-app
tc init --name my-app --key-only
```

Useful flags:

| Flag                     | What it does                                                 |
| ------------------------ | ------------------------------------------------------------ |
| `--host <url>`           | Set the node URL for the new profile                         |
| `--default-space <name>` | Set the profile's default space name                         |
| `--paste`                | Use manual paste mode if the browser callback is unavailable |
| `--no-popup`             | Print the OpenKey URL instead of opening a browser           |

## Sign in

```bash theme={null}
tc auth login
tc auth login --method openkey
tc auth login --method local
```

OpenKey sign-in opens a browser flow. Local-key sign-in uses the profile's private key without a browser.

```bash theme={null}
tc auth login --method openkey --paste
tc auth login --method openkey --no-popup
```

## Check state

```bash theme={null}
tc auth status
tc auth whoami
tc auth logout
```

`tc auth status` shows whether the profile is signed in, which DID is active, and whether the session is still valid.

## OpenKey host overrides

OpenKey auth uses this resolution order:

1. `TC_OPENKEY_HOST`
2. `profile.json` `openkeyHost`
3. `https://openkey.so`

That lets you point a profile at a self-hosted OpenKey instance without changing the CLI command itself.

## Automation

Use `TC_PRIVATE_KEY` or `--private-key` for commands that need a signer in headless environments.

```bash theme={null}
export TC_PRIVATE_KEY=0xabc123...
tc auth login --method local
```

<Note>
  The CLI source accepts both interactive OpenKey flows and local-key flows. `tc init` and `tc auth login` share the same browser callback and paste-mode behavior.
</Note>