Authentication

Every CLI command is scoped to one org. The CLI authenticates with an org-scoped deploy API key — a string of the form urun_sk_ followed by 43 base64url characters (for example urun_sk_0a1B2c3D4e5F6g7H8i9J0k1L2m3N4o5P6q7R8s9T0uV).

Before you log in: get access and a key

You authenticate the CLI with a deploy API key, which lives in the console:

1. Get into an org. Sign in to the uRun console. If you don't have access yet, request access and an operator provisions your org.
2. Create a key. In the console, go to Settings → API Keys and create a deploy key (urun_sk_ + 43 base64url chars). Copy it once — it's shown in full only at creation. See API Keys.
3. Note your org id. It's on the same Settings area, and urun org prints it after login (you'll need it for the browser client's orgId).

Then log in with the key below.

Interactive login

Run urun login with the key. The CLI verifies it against the control plane's org/config endpoint, then stores the key, your org_id, and the key_id locally so later commands pick them up automatically.

urun login --api-key urun_sk_0a1B2c3D4e5F6g7H8i9J0k1L2m3N4o5P6q7R8s9T0uV

Authenticated successfully. Credentials saved.
Login currently uses a manually vended deploy API key.
Org: org_01J...
Key ID: key_01J...
Credentials: ~/.config/urun/credentials.json

If you omit --api-key in an interactive terminal, the CLI opens the console's API Keys page in your browser (--no-browser prints the URL instead) and prompts for the key without echoing the input. You can also set it in the environment before logging in:

export URUN_API_KEY=urun_sk_0a1B2c3D4e5F6g7H8i9J0k1L2m3N4o5P6q7R8s9T0uV
urun login

CI and automation

For non-interactive environments, skip login entirely and provide credentials per invocation through environment variables. Every command reads them:

export URUN_API_KEY=urun_sk_0a1B2c3D4e5F6g7H8i9J0k1L2m3N4o5P6q7R8s9T0uV
urun deploy app.py

Per-command --api-key and --api-url flags override the environment.

Credential resolution order

For any command, credentials are resolved in this order:

1. The explicit --api-key / --api-url flags on the command.
2. The URUN_API_KEY / URUN_API_URL environment variables.
3. The credentials saved by urun login.
4. For the URL only: the built-in default https://api.urun.sh/v1.

Confirm who you are

urun org

Prints just your org_id on stdout (machine-readable, nothing else) — useful for scripts and for the orgId your browser client needs:

org_01J6X9Y2ABCDEF...