blowhorn auth

blowhorn auth: login, logout, status.

The blowhorn auth commands. Each one's --help prints the same text.

Command	What it does
`auth login`	Sign in to Layer5 Cloud in your browser.
`auth logout`	Sign out of Layer5 Cloud and clear the local entitlement attestation cache.
`auth status`	Show whether Layer5 Cloud credentials and an entitlement attestation are present.

Opens Layer5 Cloud, where you sign in or create an account and allow Blowhorn, then returns here and keeps the token in the macOS Keychain (elsewhere a file only you can read beside cloud.yaml). It uses Layer5 Cloud's native client sign-in: Cloud answers on 127.0.0.1 with a one-time code this command redeems with a PKCE verifier; there is no client secret, and the token is never printed. After sign-in it reads your plan once; an account without Blowhorn is sent straight to Layer5 Cloud to start the beta. --no-browser prints the sign-in address instead of opening it; --json opens no browser either, its first line names the address to open (the desktop app runs --no-browser --json and opens it itself). --dry-run names where it would sign in and opens, waits for and saves nothing.

output

blowhorn auth login [OPTIONS]

Flag	Type	Default	Description
`--sign-up`	boolean	`false`	Open Layer5 Cloud to create a new account instead of signing in; it comes back the same way.
`--no-browser`	boolean	`false`	Print the sign-in address and wait for the answer on 127.0.0.1 without opening a browser (--json implies it).
`--json`	boolean	`false`	Emit machine-readable JSON output
`--platform`	string		Accepted and ignored by 'blowhorn auth': this command never acts on a platform, so --platform has no effect here -- including a value inherited from BLOWHORN_PLATFORM or defaults.platform in .blowhorn.yaml
`--pace`	string		Accepted by 'blowhorn auth login' because --pace is a global flag, but this command does no paced work -- it opens no browser and sleeps between nothing -- so the value changes nothing about how it runs and appears only in the Pace column of the -v summary. Resolved as CLI flag, then BLOWHORN_PACE, then defaults.pace in .blowhorn.yaml (normal when none is set); an unrecognized value is rejected before anything runs

Also takes the shared flags: --config, --log-dir, --profile, --exclude, --headless, --chrome-launch, --headed, --dry-run, --verbose.

Examples:

terminal

$ blowhorn auth login
$ blowhorn auth login --sign-up
$ blowhorn auth login --no-browser --json

Output: json with --json, text otherwise.

blowhorn auth logout

Sign out of Layer5 Cloud and clear the local entitlement attestation cache.

Removes the token 'blowhorn auth login' saved (Keychain item ai.blowhorn.cloud-token), the account it wrote to cloud.yaml (organization_id, display_name), the process cache and the Keychain attestation item (ai.blowhorn.entitlement.v2). Unset BLOWHORN_CLOUD_TOKEN in the shell if it was exported.

output

blowhorn auth logout [OPTIONS]

Flag	Type	Default	Description
`--json`	boolean	`false`	Emit machine-readable JSON output
`--platform`	string		Accepted and ignored by 'blowhorn auth': this command never acts on a platform, so --platform has no effect here -- including a value inherited from BLOWHORN_PLATFORM or defaults.platform in .blowhorn.yaml
`--pace`	string		Accepted by 'blowhorn auth logout' because --pace is a global flag, but this command does no paced work -- it opens no browser and sleeps between nothing -- so the value changes nothing about how it runs and appears only in the Pace column of the -v summary. Resolved as CLI flag, then BLOWHORN_PACE, then defaults.pace in .blowhorn.yaml (normal when none is set); an unrecognized value is rejected before anything runs

Also takes the shared flags: --config, --log-dir, --profile, --exclude, --headless, --chrome-launch, --headed, --dry-run, --verbose.

Examples:

terminal

$ blowhorn auth logout
$ blowhorn auth logout --json

Output: json with --json, text otherwise.

blowhorn auth status

Show whether Layer5 Cloud credentials and an entitlement attestation are present.

Reports token configured (never the token value), organization id, api_base, enforcement mode (BLOWHORN_ENTITLEMENT), and a summary of the last Feature read.

output

blowhorn auth status [OPTIONS]

Flag	Type	Default	Description
`--json`	boolean	`false`	Emit machine-readable JSON output
`--platform`	string		Accepted and ignored by 'blowhorn auth': this command never acts on a platform, so --platform has no effect here -- including a value inherited from BLOWHORN_PLATFORM or defaults.platform in .blowhorn.yaml
`--pace`	string		Accepted by 'blowhorn auth status' because --pace is a global flag, but this command does no paced work -- it opens no browser and sleeps between nothing -- so the value changes nothing about how it runs and appears only in the Pace column of the -v summary. Resolved as CLI flag, then BLOWHORN_PACE, then defaults.pace in .blowhorn.yaml (normal when none is set); an unrecognized value is rejected before anything runs

Also takes the shared flags: --config, --log-dir, --profile, --exclude, --headless, --chrome-launch, --headed, --dry-run, --verbose.

Examples:

terminal

$ blowhorn auth status
$ blowhorn auth status --json

Output: json with --json, text otherwise.

Last modified October 18, 2026

blowhorn auth

blowhorn auth login

blowhorn auth logout

blowhorn auth status

Cookies