Skip to content

Tokens & API keys

Autolab has two kinds of secret, and they're easy to mix up:

  • Access tokens (PATs) — authenticate you (the CLI) to the control node.
  • LLM provider keys — the Anthropic/OpenAI/… keys the agent uses to think.

Signing in

autolab login      # browser sign-in; stores a token for this host
autolab whoami     # show the active host and signed-in user
autolab logout     # remove the stored token for this host

Tokens are stored per host in ~/.config/autolab/credentials.json (owner-only), so logins to different hosts coexist without clobbering each other.

Headless login

On a remote box, CI runner, or anywhere without a browser, pass a token directly:

autolab login --token "$AUTOLAB_TOKEN"

Or skip storage entirely and let the environment variable carry it for a single command — for control-node requests, AUTOLAB_TOKEN is used ahead of any stored login:

AUTOLAB_TOKEN=al_… autolab serve

Personal access tokens

A PAT is the same credential the browser login mints — a revocable token that acts as you on every project you can access. Manage them from the CLI or the dashboard's Access Tokens tab.

autolab token                        # print the token you're authenticated with
autolab token create --name gpu-box  # mint a fresh, named token (prints it once)
autolab token ls                     # list your tokens
autolab token revoke gpu-box         # revoke by name or id-prefix

Prefer a named token create over the bare print, so you can revoke just that one later. Pipe tokens, don't paste them where they'll be logged:

TOK=$(autolab token create --name gpu-box)
ssh gpubox "AUTOLAB_TOKEN=$TOK autolab serve"

Researcher+ for compute nodes

Registering an compute node clones private code, so the token must belong to a researcher, admin, or owner on that project.

LLM provider keys

The agent needs an LLM to write code and analyze results. Every project runs on your AutoLab Key — platform credits, nothing to set up. The dashboard's Credits tab shows your balance and usage and takes top-ups. Bringing your own provider key is not available at the moment.

Next: Drive the agent, or attach compute with Compute.