Authentication & API keys

Subaya supports two authentication modes against the same API.

API keys — SUBAYA_API_KEY (agents & CI)

The simplest path, and the one to use for AI agents and CI pipelines. Set the environment variable and every suya command (and the platform API) picks it up:

export SUBAYA_API_KEY="sk_..."
suya auth whoami      # confirm the identity the key resolves to

No browser, no interactive step — ideal for headless environments. Issue and manage keys from the console.

OAuth browser login (humans)

For interactive use on a workstation:

suya auth login                 # opens a browser (loopback redirect)
suya auth login --no-browser    # manual-code fallback for remote/headless shells

The CLI stores the resulting token locally (under ~/.config/suya/). Check or clear it:

suya auth status    # local status, without calling the server
suya auth logout    # log out and revoke the local token

Precedence

When more than one credential is present, suya resolves in this order:

1. The --token global flag
2. SUBAYA_API_KEY
3. The locally stored OAuth token (~/.config/suya/auth.json)

Pointing at a different host

All commands accept --host (default https://subaya-dev.com) if you need to target a non-default API endpoint.

Next steps

• Quickstart — run your first simulation.
• CLI: auth — the full suya auth reference.