Skip to main content
Sign in to connect the CLI to your Beam workspace.

​
Sign In

Finish signing in or creating an account in your browser. On a remote machine, use beam login --browserless and open the printed link on another device. Credentials are saved in ~/.beam/config.ini.

​
Named Contexts

Save credentials under a name and select that context when running commands:
Use beam config select production to change the default context, or beam config create to connect to a self-hosted gateway.

​
CI and Server-side SDKs

Save an API token as BEAM_TOKEN in your CI secrets. The Python SDK and CLI use it for the default context:
--json returns JSON and disables prompts. Check the exit status for failures. For TypeScript, set beamOpts.token on the server. Keep tokens out of source control and browser code.

​
Coding Agents

Use agent setup for local tools. Remote MCP clients sign in through OAuth and refresh access tokens automatically.

​
VM Application Access

Workspace credentials manage resources; a VM traffic token or browser session authenticates protected application ports. The terminal and enabled desktop are protected by default. The CLI handles browser authentication automatically:
Signed links last 10 minutes by default. Treat them as credentials and rerun the command for a fresh link after expiry. For HTTP clients, use the VM traffic token in X-Beam-VM-Token, not the workspace API token. See VM networking for SDK and MCP access, revocation, and private port forwarding. VMs and sandboxes receive no automatic workspace token. If a guest needs workspace API access, explicitly bind a BETA9_TOKEN or BEAM_TOKEN secret; these are plaintext opt-ins. Other runtime secrets use brokered placeholders.