Authentication and keys

Cloud offers self-service signup while early-release places are available. Sign in with Google or email/password in the browser. The CLI never asks for your password.

banh login                # or --no-browser to open the link elsewhere
banh whoami --json
banh logout               # removes local credentials only

Sessions expire; run banh login again when prompted. logout doesn’t revoke API keys or sign you out of Google. Forgot your password? Use Forgot password? on the sign-in screen.

Automation credentials

Account owners create invocation keys for apps and CI:

banh keys create          # secret is shown once
banh keys list
banh keys revoke <key-id> # takes effect immediately

Variable	Value
BANH_API_TOKEN	Invocation secret from banh keys create.
BANH_ACCOUNT_ID	Account ID from banh whoami --json.
BANH_API_URL	Optional. Defaults to https://api.banh.dev.

With these set, banh invoke uses the key. Keys can invoke workflows and read run history only. They can’t deploy, manage keys or billing, or call whoami.

Keep secrets in a secret store, never in issues or source control. An invocation key is not the same as BANH_INFERENCE_TOKEN, which is your TypeSafe key for local runs.