> ## Documentation Index
> Fetch the complete documentation index at: https://docs.jelou.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and profiles

> Log in, manage multiple accounts as profiles, switch companies, and understand the credential resolution order of the Jelou CLI.

The CLI stores credentials in `~/.jelou/credentials.json` with **multi-profile**
support: multiple accounts (and companies) coexist as named profiles.

## `jelou login`

Authenticate with your **Jelou API key**. `jelou login` saves it as a named
profile and makes it the active one. Get your API key at
[apps.jelou.ai/settings/api-keys](https://apps.jelou.ai/settings/api-keys).

```bash theme={null}
jelou login                                       # interactive: prompts to paste the API key
# ? Paste your API key: ****
jelou login --token $JELOU_TOKEN --profile prod   # non-interactive (CI)
```

| Flag               | Description                           |
| ------------------ | ------------------------------------- |
| `--token <token>`  | API key for non-interactive use (CI)  |
| `--profile <name>` | Name of the profile to save           |
| `--skip-skills`    | Don't auto-install skills after login |

On the **first successful login**, `jelou` automatically installs the agent
skills globally in the detected AI editors (Claude Code, Cursor,
Codex…), so new sessions know about `jelou`. See
[Skills](/en/guides/cli/skills).

## `jelou whoami`

Check the current identity and the API URL.

```bash theme={null}
jelou whoami
jelou whoami --json
```

## `jelou logout`

Remove stored credentials.

```bash theme={null}
jelou logout                  # forget the active profile
jelou logout --profile prod   # forget a specific profile (without switching to it)
jelou logout --all            # forget all profiles
```

<Warning>
  Credentials are not recoverable: after `logout`, you'll have to run
  `jelou login` again, and the skills that were auto-installed at login do not
  reinstall on their own. `logout --all` (or `logout` when only one profile
  remains) is a destructive operation — confirm before running it.
</Warning>

## Profiles

Each profile normally maps 1:1 to a company. Switching profiles changes the
active company: `jelou project list` returns the projects of the new company,
`jelou databases list` its databases, etc.

```bash theme={null}
jelou login --token <tok> --profile staging   # add a second profile
jelou profiles                                 # list all (alias of `auth list`)
jelou auth list                                # list all profiles
jelou auth switch staging                      # switch the active profile
jelou auth remove staging                      # remove a profile
jelou functions deploy --profile production    # one-time override (not persisted)
```

<Tip>
  For a one-off query against another company, prefer `--profile <name>` on
  that command instead of `auth switch`. The active profile is **sticky**: if
  you switch to "staging" to read a value and forget to switch back, the next deploy,
  deletion, or secret rotation will point at the wrong company.
</Tip>

### Credential resolution order

The CLI resolves which credential to use in this order (highest to lowest priority):

1. `JELOU_TOKEN` environment variable
2. `--profile <name>` flag
3. `JELOU_PROFILE` environment variable
4. `.jelou/state.json:profile` — per-directory binding that `jelou link`
   writes when linking the project, using whichever profile is active at
   that moment (or the one you pass with the global `--profile <name>`
   flag on that same command)
5. `activeProfile` in the credentials file

When you see "wrong company", review this order before assuming the
file is wrong.

## Health and diagnostics

When something looks off (auth, network, "wrong company", profile drift),
run `jelou doctor` first:

```bash theme={null}
jelou doctor          # human-readable report
jelou doctor --json   # structured for agents/CI
```

It checks: token validity, gateway reach, profile sanity,
lockfile integrity (if there's a `jelou.lock` in the directory), and freshness of
the CLI version. Exit codes: `0` healthy, `4` auth failure, `6` gateway
unreachable, `1` other failure.

## Credential security

* The API keys in `~/.jelou/credentials.json` are sensitive credentials — never
  publish them in a repo or paste them in a chat.
* v1 credentials (old format) are automatically migrated to v2, leaving
  a `.bak` backup. Don't delete that `.bak`: it's the only fallback if the
  v2 file gets corrupted.