> ## Documentation Index
> Fetch the complete documentation index at: https://docs.helix-db.com/llms.txt
> Use this file to discover all available pages before exploring further.

# helix auth

> Manage the CLI WorkOS session

<div className="flex flex-wrap gap-2"><Badge color="gray" size="sm">Reference</Badge></div>

```bash theme={"languages":{"custom":["languages/helixql.json"]}}
helix auth login
helix auth status
helix auth logout
```

`login` starts WorkOS PKCE in a browser, receives the loopback callback, hydrates all current
workspace memberships, and stores only the rotating WorkOS session in `~/.helix/credentials`.
The CLI refreshes tokens within 60 seconds of expiry and serializes refreshes across processes.

`status` verifies the session and reports its user and membership count. `logout` asks WFE to
revoke the session when possible and always deletes the local file.

The credential file is mode `0600` and rejects old key fields. Cloud commands do not accept
environment API keys, service credentials, legacy user/admin keys, or custom authorization headers.