---
title: "wendy cloud login"
description: "Log in to Wendy Cloud or a local pki-core instance"
---

## Syntax

```sh
wendy cloud login [flags]
```

## Examples

```sh
wendy cloud login --help
```

## Arguments

No positional arguments are declared in the command synopsis.

## Flags

Flags below include inherited options. Types and defaults come from the CLI source. An empty default means no value is configured.

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--api-key` | string | (empty) | Bearer API key for local pki-core authentication |
| `--auth` | string | `https://auth.dev.wendy.sh` | wendy-auth base URL used with --email |
| `--client-id` | string | `wendy-cli` | public DPoP OAuth client ID registered in wendy-auth |
| `--cloud` | string | (empty) | Cloud dashboard URL |
| `--cloud-grpc` | string | (empty) | Cloud gRPC endpoint, or local pki-core address (host:port) when using --api-key |
| `--device` | string | (empty) | Target device hostname; `wendy run` accepts a comma-separated list to deploy one build to several devices (needs a remote build host and --detach). Defaults to $WENDY_DEVICE, then the saved default device |
| `--email` | string | (empty) | Email address used to discover your organization and sign in with wendy-auth |
| `--issuer` | string | (empty) | wendy-auth realm issuer URL, e.g. https://auth.wendy.sh/realms/acme (enables OIDC login) |
| `--json` | bool | `false` | Output in JSON format |
| `--legacy` | bool | `false` | Use the old Wendy Cloud dashboard enrollment flow (cloud.wendy.sh) (the temporary default unless --email, --issuer, or --api-key is provided) |
| `--org` | int32 | `1` | Organization ID for --api-key local login. For Wendy Cloud, each login is stored as an auth context; switch with 'wendy auth use <context>'. |
| `--pki-identity-endpoint` | string | `https://identity.dev.pki.wendy.sh/v1/identity/certificate` | pki-core operator identity CSR endpoint (used with OIDC login) |
| `--pki-resource` | string | `https://pki.wendy.sh/identity` | RFC 8707 pki-core identity resource (used with OIDC login) |
| `--print-claims` | bool | `false` | Print the decoded access-token claims after login (used with --issuer) |
| `--resource` | string | (empty) | RFC 8707 API resource indicator (used with OIDC login) |
| `--service-account` | string | (empty) | Service-account key file for headless login (or set WENDY_SERVICE_ACCOUNT_KEY to its contents) |

## Output

Output depends on the operation and selected target. [Command behavior and detailed examples](../../../../advanced/clients/wendy-cli/commands/cloud/login/).

## JSON output

The global `--json` option requests machine-readable output. The CLI also selects JSON mode when no interactive terminal is attached. Support and payloads are command-specific; this flag does not guarantee a single JSON document for commands that stream logs or invoke build tools. Consult Details before parsing command output.

## Exit codes

The CLI entry point returns `0` on success and for its user-cancelled or default-cleared results. Other returned errors exit with `1` and print a diagnostic to stderr. Some operations may terminate through subprocess or signal handling; do not infer application health from the CLI exit code alone.

## Common errors

Check argument values and flag combinations against the synopsis above. For discovery, build, port, and readiness failures, see [deployment troubleshooting](../../../../errors/). Command-specific constraints are in Details.

## See also

- [wendy cloud](../../../../reference/cli/cloud/)
- [CLI conventions and configuration](../../../../reference/)

## Details

Signs in to Wendy Cloud. For now, defaults to the legacy dashboard login (cloud.wendy.sh). For the OIDC flow, pass --email to discover your realm (or --issuer to name it), sign in with authorization code + PKCE, obtain an operator certificate directly from pki-core, and save a refreshable Cloud API session.
With --api-key: issues a certificate from a self-hosted pki-core instance using a Bearer API key.
With --service-account <key-file> (or WENDY_SERVICE_ACCOUNT_KEY): signs in headlessly as a wendy-auth service account; no browser or terminal is needed.
With --legacy: uses the old Wendy Cloud dashboard enrollment callback (cloud.wendy.sh). Kept for the previous cloud only.

[Command behavior and detailed examples](../../../../advanced/clients/wendy-cli/commands/cloud/login/)