Login and context

Commands

This page documents the following commands. Global flags that apply to every command are listed under daytona.

Command	Description
`daytona login`	Sign in with your browser, a device code, or a static credential
`daytona logout`	Remove the saved session and revoke its CLI-minted project keys
`daytona profile`	Manage named connections (API URL + credential + org/project context)
`daytona whoami`	Show who you are, which credential is in use, and the selected org/project

Signs in to the Daytona API (https://api.daytona.com) and saves the session in the active profile. For a test environment, point the CLI at another API with DAYTONA_V2_API_URL (or DAYTONA_API_URL, or --api-url); the profile remembers it.

Default at a terminal: opens your browser (authorization code + PKCE on a loopback redirect) and prints the URL too — nothing to type, approve and you are done. Without a terminal (agents, CI) or inside an SSH session (where a browser on your machine cannot reach this host's loopback redirect) the CLI switches to the device flow automatically; --device forces it — you open a URL on any device and enter a short code. --token: stores a static credential (a project API key, an org API key, or any bearer the server accepts) as-is. The CLI never inspects it; the server decides what it may do.

After a browser or device login the CLI selects your personal organization and its default project the first time, and remembers your last selection afterwards. Sandbox commands use a short-lived platform token where supported; toolbox access and other deployments use a CLI-minted project API key with a 24-hour expiry. Replacement attempts to revoke superseded keys; logout attempts to revoke cached login-minted keys.

daytona login [flags]

Examples

daytona login
daytona login --device
daytona login --token dtn_…

Flags

Long	Type	Description
`--browser`	`bool`	force the browser (loopback) flow even inside an SSH session — for when you forward the callback port with `ssh -L`
`--client-id`	`string`	OIDC client id override (default: the API's oidc.cli_client_id, or DAYTONA_OIDC_CLIENT_ID)
`--device`	`bool`	device-code login for hosts without a browser
`--token`	`string`	store this static credential instead of signing in

daytona logout

Remove the saved session and revoke its CLI-minted project keys

Deletes the active profile's saved tokens and cached workload credentials from this machine, then attempts to revoke its cached login-minted project keys against the profile's saved API (at most 3 seconds total). Local logout completes even when that API is unavailable. Keys whose revocation fails expire server-side.

Does not revoke manually supplied credentials, static-credential exchanges, other profiles' keys, keys from other APIs, or the identity provider's session. Keys no longer tracked after credential replacement or identity change are not revoked. --api-key and API URL overrides are not used for logout cleanup.

daytona logout

daytona profile

Manage named connections (API URL + credential + org/project context)

Commands

Command	Description
`daytona profile delete`	Delete a profile and its saved credentials
`daytona profile list`	List profiles
`daytona profile use`	Make a profile the active one