Authentication

Authenticate the OutRay CLI with your account using the browser-based OAuth flow.

Before you can open a tunnel, you need to authenticate the CLI with your OutRay account.

Logging in

1. Run the login command

   outray login
   

   The CLI starts a local authentication session and prints a fallback URL in case your browser does not open automatically:

   Opening browser for authentication...
   
   If browser doesn't open, visit:
   https://outray.dev/cli-auth?code=...
   
   Waiting for authentication...
   
2. Authenticate in the browser

   Your default browser opens to the OutRay dashboard. Sign in with your account and authorize the CLI. Once you approve, the browser confirms the login and you can close the tab.

3. Select an organization

   After authenticating, the CLI fetches the organizations you belong to and prompts you to select one:

   ✓ Authenticated successfully
   ? Select an organization: (Use arrow keys)
   ❯ my-workspace
     acme-corp
   

   The selected organization becomes your active context for all tunnel commands.

4. Confirm successful login

   The CLI saves your credentials locally and prints a confirmation:

   ✔ Logged in successfully
   ✔ Active org: my-workspace
   

Checking your authentication status

To see which account and organization are currently active, run:

outray whoami

Example output:

Authentication Status

Active Organization:
  My Workspace (my-workspace)

Role: owner

If you have access to multiple organizations, the output also reminds you that you can switch between them.

Switching organizations

To switch to a different organization interactively:

outray switch

To switch directly by slug without a prompt:

outray switch acme-corp

Token auto-refresh

OutRay uses a short-lived organization token to authenticate tunnel connections. When the token expires, the CLI silently re-exchanges it using your stored user token — you will not be prompted to log in again:

Refreshing authentication...

No manual action is required. Your tunnels continue working without interruption.

Using an API key instead

For environments without a browser — such as CI/CD pipelines or remote servers — you can bypass the OAuth flow by passing an API key directly with the --key flag:

outray http 3000 --key outray_sk_...

Generate an API key from your organization settings in the dashboard.

API keys are scoped to a single organization. They do not require outray login and do not refresh automatically.

Logging out

To clear all stored credentials from your machine:

outray logout

✔ Logged out successfully