Authentication
How orl stores your API key, resolves your organization, and reads configuration.
orl authenticates with an OpenRelay API key (vl_...), the same key the
REST API uses. Log in once and orl keeps it in your OS
keyring.
Log in
orl auth loginPaste the key when prompted (create one in the dashboard under Settings > API Keys). To pipe a key in from a script or secrets manager, read it from stdin:
echo "$OPENRELAY_API_KEY" | orl auth login --with-tokenYour org comes from the key
An organization is your account's workspace: it owns your keys, VMs, and
balance. Each API key is bound to one org, so orl reads the org from the key
and you never pass an org id. See exactly who you are acting as:
orl auth status # where your key is stored and whether it works
orl account whoami # the principal and the org it acts inWhere the key is stored
orl auth login uses your operating system keyring (macOS Keychain, GNOME
Keyring / libsecret, Windows Credential Manager). The plaintext key never lands
in a config file.
On a headless box with no keyring, orl refuses to write plaintext unless you
opt in:
orl auth login --with-token --insecure-storageThat writes the key to a 0600 file in the config directory. Prefer the
OPENRELAY_API_KEY environment variable in CI instead (below).
Configuration precedence
For each setting, orl takes the first source that is set:
| Setting | Flag | Environment | Stored / default |
|---|---|---|---|
| API key | --api-key | OPENRELAY_API_KEY | keyring / consented file |
| Organization | --org | OPENRELAY_ORG_ID | resolved from the key |
| API base URL | --api-url | OPENRELAY_API_URL | https://api.openrelay.inc |
So a flag beats an environment variable, which beats what orl auth login
stored. In CI, set OPENRELAY_API_KEY and skip orl auth login entirely.
Log out
orl auth logoutRemoves the stored key for the current API host. To rotate a key, create a new one in the dashboard, log in again, then revoke the old one.