Authentication

Both the CLI and the Python SDK authenticate with the same API key. There are three ways to supply it; the first one found wins.

Resolution order

1. An explicit flag or constructor argument (--api-key, api_key=...)
2. The REFLEX_API_KEY environment variable
3. The credentials file written by reflex login

If none are set, commands and SDK calls fail with:

Error: API key is required. Run `reflex login` or set REFLEX_API_KEY.

Recommended: reflex login

reflex login

This opens your browser, prompts you to approve the device, and writes an API key to a local credentials file. Subsequent CLI commands and SDK calls pick it up automatically.

If a browser cannot open (headless server, SSH session), the CLI prints the approval URL — open it on a machine where you can sign in:

reflex login --timeout 0
# Prints the approval URL and exits.
# Approve in a browser, then run `reflex login` again on the headless host.

API keys for CI and scripts

For non-interactive environments, set the key as an environment variable instead of running reflex login:

export REFLEX_API_KEY=rfx_...

You can mint additional keys from the dashboard at app.tryreflex.ai. Treat keys as secrets — they grant full access to your organization's runs, datasets, and deployments.

Credentials file

reflex login writes to:

~/.config/reflex/credentials.json

Permissions are set to 0600 (owner read/write only). The file contains the API key and the platform URL that was used at login time.

Override the location with:

Remove the file (and revoke the local session) with:

reflex logout

Verifying the active identity

reflex whoami

Prints the account and organization the current key belongs to. Useful for sanity-checking which key a script will use when both REFLEX_API_KEY and a saved credentials file are present.

Environment variable reference

RFX_API_KEY is accepted as a legacy alias for REFLEX_API_KEY.