CLI Authentication

How to authenticate the SOFE CLI — browser login, API keys, and multiple profiles.

sofe login (Recommended)

The easiest way to connect your CLI. Opens your browser, you sign in, and the CLI is automatically configured.

sofe login

How it works

SOFE Login

  Opening browser...

  If it doesn't open, go to:
  https://platform.sofe.dev/device

  Enter this code:
  SOFE-P1IK

  ◐ Waiting for confirmation...

  ✓ Logged in as [email protected]
  ✓ API key saved to ~/.sofe/config.yaml
  ✓ Mode set to: cloud

Step by step

1. Run sofe login in your terminal
2. Your browser opens to platform.sofe.dev/device
3. Sign in with Google (if not already signed in)
4. Enter the code shown in your terminal (e.g., SOFE-P1IK)
5. Click "Confirm & Connect"
6. Your terminal automatically detects the confirmation and saves the API key

The code expires after 5 minutes. If it expires, just run sofe login again.

Cross-device login

You can copy the URL and code to any device — even your phone. The CLI is polling and will pick up the approval regardless of which browser you use to confirm.

API Key (Alternative)

If you prefer to manage keys manually, or need keys for CI/CD:

# Option 1: Set via CLI
sofe config set api-key sk_sofe_your_key_here

# Option 2: Environment variable
export SOFE_API_KEY=sk_sofe_your_key_here

# Option 3: Pass per-command
sofe evaluate --cloud --api-key sk_sofe_xxx

Get API keys at platform.sofe.dev/keys.

sofe upgrade

Interactive onboarding — opens platform, guides you through key creation.

sofe upgrade          # connect to cloud (free tier)
sofe upgrade pro      # upgrade to Pro tier (opens pricing)

When to Use Each Method

Config File

All auth state is stored at ~/.sofe/config.yaml (permissions 0600):

mode: cloud
api_url: http://localhost:8080
cloud_url: https://api.sofe.dev
api_key: sk_sofe_cb7d1234...
default_format: table
aws_profile: ""
policies_dir: ./policies

Verify Authentication

sofe status    # shows mode, key, last eval
sofe history   # if this works, auth is correct