Skip to main content
The AhaSend CLI saves your API credentials as profiles, so you can work with several accounts or environments.

​
Getting Started

Create a full API key under Account Settings → API Keys, with the scopes your commands need, and copy the account ID from account settings. See API authentication.

​
Interactive Login

On a terminal, the command asks for your API key and your account ID on stderr, and hides the key as you type it. When stdin is not a terminal, it reads the key and the account ID as two lines of stdin, and empty stdin cancels it with exit code 4; the auth reference shows how to pipe them in. Profiles says which name the profile gets. Before it saves anything, the command reads the account to check that the key belongs to the account ID:
  • A key the API rejects, or a key of another account, fails with exit code 2.
  • A key whose IP allow list leaves out this machine fails with exit code 6.
  • A key without the scope to read the account belongs to the account, and is saved.

​
Direct Login

Give both flags or neither: one alone fails with exit code 4. A key passed as a flag can end up in your shell history. Prefer the prompt on your own machine.

​
CI Credentials

In CI, skip auth login: store the API key and account ID as secrets and pass them with the global flags:
The CLI reads no environment variable for credentials or profiles. --api-key always uses the production API and cannot be combined with --profile. See CI credentials for the rules.

​
Profiles

​
Creating Profiles

Profiles says which profile becomes the default. When a login keeps another profile as the default, its output says how to switch to the new one. To log in to a profile again, run auth login with its name; the login replaces the profile’s credentials without asking.

​
Switching Profiles

auth switch checks the profile’s key first. When the check fails, it prints a warning on stderr and switches anyway.

​
Check Status

auth status shows the profile, its account ID, whether the API accepts its key for that account, and the account. It exits nonzero when the key cannot be verified.

​
Remove Profiles

auth logout staging removes the profile at once, without a prompt. You can also name the profile with --profile, as in ahasend auth logout --profile staging. auth logout without a profile removes the default profile. When you remove the default profile and one profile is left, that profile becomes the default. When several are left, none is the default until you run ahasend auth switch <profile>.

​
Credential Storage

Profiles live in ~/.ahasend/config.yaml, which holds your API keys in plain text and is readable by your user only. No auth command prints a profile’s API key. apikeys create and subaccounts api-keys create print the new key’s secret once, so store it when you create the key. See Configuration File.
Keep your API keys secure. Never commit credentials to version control.

​
Testing Authentication

Verify your setup:
ping checks that the API can be reached and accepts your key. auth status also checks that the key belongs to the profile’s account.

​
Next Steps