porter auth contains commands for authenticating with Porter.
porter auth login
Authenticate with your Porter account. By default, this opens your browser to complete authentication.
Usage:
| Flag | Description |
|---|---|
--token | Log in using an existing token |
After logging in, Porter automatically sets your default project and cluster if you have access to any. You can view these with
porter config.Handling stale or rejected tokens
porter auth login automatically recovers from invalid credentials:
- Stale on-disk token: If your saved token is no longer valid, Porter clears it locally, prints a warning, and falls through to the browser login flow — no need to run
porter auth logoutfirst. - Rejected
PORTER_TOKEN: If the server rejects a token sourced from thePORTER_TOKENenvironment variable, login fails with a clear error prompting you tounset PORTER_TOKENbefore retrying. This avoids silently overwriting a token your CI environment is providing.
porter auth logout
Log out from Porter and clear your local credentials.
Usage:
porter auth logout no longer requires a valid session to run. It will:
- Revoke your session server-side when possible.
- Treat
401,403, or404responses from the revoke endpoint as “already invalid” and still clear your local credentials, so an expired session can never strand you logged in locally. - Preserve local credentials on other server errors (for example, a transient
5xx) so a temporary outage doesn’t silently leave a valid refresh token behind a “successful” logout. - Warn you if
PORTER_TOKENis still set in your environment after logout, since that variable overrides on-disk credentials on the next command.

