> ## Documentation Index
> Fetch the complete documentation index at: https://learn.nexudus.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to log in, log out, and manage credentials with the Nexudus CLI.

# Authentication

The Nexudus CLI authenticates against the Nexudus REST API using your Nexudus account email and password. Credentials are stored securely in your operating system's native credential store.

## Credential storage

| Operating system | Storage backend                        |
| ---------------- | -------------------------------------- |
| Windows          | Windows Credential Manager             |
| macOS            | macOS Keychain                         |
| Linux            | libsecret (GNOME Keyring / KDE Wallet) |

Credentials are never stored in plain text on disk.

## Log in

```bash theme={null}
nexudus login
```

The CLI prompts you for your Nexudus email and password. After entering them, the CLI validates your credentials by calling the Nexudus API and stores them securely if successful.

<Warning>The admin CLI currently uses Basic Authentication (username and password). OAuth/Bearer token support is planned for a future release.</Warning>

## Public API Authentication

In addition to admin authentication, the CLI supports the **Public API**, which lets you authenticate as a member of a coworking space. Public API tokens are stored separately from admin credentials, so you can use both contexts simultaneously.

### Log in as a member

```bash theme={null}
nexudus public login --web-address myspace --email you@example.com --password your-password
```

| Option          | Description                                        |
| --------------- | -------------------------------------------------- |
| `--web-address` | The subdomain of your location (e.g., `myspace`)   |
| `--email`       | Your member email address                          |
| `--password`    | Your member password                               |
| `--totp`        | Two-factor authentication code (if 2FA is enabled) |

### Verify your member session

```bash theme={null}
nexudus public whoami
```

### Log out as a member

```bash theme={null}
nexudus public logout
```

This only clears public API (member) credentials — your admin credentials remain unaffected.

For the full reference of public API commands, see [Public API Commands](/cli/public-api).

## Verify your session

```bash theme={null}
nexudus whoami
```

This displays your authenticated user information including your name, email, and default business. It also returns useful defaults that commands use automatically:

| Default                   | Description                           |
| ------------------------- | ------------------------------------- |
| `DefaultBusinessId`       | Your primary business (location) ID   |
| `DefaultCurrencyId`       | The default currency for your account |
| `DefaultCountryId`        | The default country for your account  |
| `DefaultSimpleTimeZoneId` | The default timezone for your account |

These defaults are used automatically when creating or updating entities so you don't have to specify them every time.

## Log out

```bash theme={null}
nexudus logout
```

This clears all stored credentials from your system's secure storage.

## Troubleshooting authentication

| Symptom                | Solution                                                                       |
| ---------------------- | ------------------------------------------------------------------------------ |
| "Not logged in" errors | Run `nexudus login` to authenticate                                            |
| "Unauthorized" errors  | Your credentials may have changed — run `nexudus login` again                  |
| "Forbidden" errors     | Your account may not have API permissions — contact your Nexudus administrator |

<Tip>Run `nexudus doctor` at any time to check whether you have stored credentials and whether the API is reachable.</Tip>