# Sign in

> Sign the maru CLI in to your Maru account with maru login, check it with maru whoami, and use tokens in CI.

Canonical: https://maruaudio.com/docs/authentication
Documentation index: https://maruaudio.com/llms.txt

Local work does not need an account: creating, developing, checking and
building a module all run on your machine. Hosted features do, for example
creating Studio projects and banks, hosted audio generation and transcription,
and your saved presets. Commands that need an account say so and exit with
code 3 when you are not signed in.

## Sign in from a browser

```bash
maru login
```

The CLI opens your browser at the Maru sign-in page and waits for you to
approve it. When no browser can be opened, for example over SSH, it prints the
sign-in URL to open on another device. See `maru login --help` for the options.

## Sign in with a token

On a server, in a container or in any terminal without a browser, create a
personal token on your [account tokens page](https://maruaudio.com/account/tokens), then pass it to
the CLI:

```bash
maru login --token <token>
```

The CLI checks the token with the platform before it saves it. Use
`--with-token` to read it from stdin instead, so it does not appear in your
shell history.

## Check and sign out

```bash
maru whoami    # account, scopes, issuer and token expiry
maru logout    # revoke the session, then delete the local credentials
```

`maru logout` reports when revocation fails and still removes the local
credentials.

## Where credentials are stored

Credentials are saved in `credentials.json`, a file readable only by your
user, in the Maru configuration directory:

| Platform | Configuration directory |
| --- | --- |
| macOS | `~/Library/Application Support/Maru` |
| Linux | `$XDG_CONFIG_HOME/maru` (default `~/.config/maru`) |
| Windows | `%APPDATA%\Maru` |
| Any, with `MARU_HOME` set | `$MARU_HOME/config` |

`MARU_HOME` must be an absolute path; it moves everything Maru keeps, including
downloaded components and caches. `maru doctor --paths` prints the exact
locations for your machine.

You can keep several accounts side by side with profiles: add
`--profile <name>` to `login` and to the commands that should use it.

## CI and automation

Set `MARU_TOKEN` to a personal token. It takes precedence over any saved
credentials and needs no `maru login` step:

```bash
MARU_TOKEN="$MARU_CI_TOKEN" maru project templates --json
```

Store the token as a secret in your CI system and give it only the access the
job needs. The same credentials are used by [`maru mcp`](https://maruaudio.com/docs/agents-and-mcp.md)
and by any command that calls a hosted service.

To call hosted services from your own site, server or script without the CLI,
use the `maruaudio/api` client described in the [Audio SDK](https://maruaudio.com/docs/audio-sdk.md#hosted-services).