# Authentication

URL: https://docs.hanzo.ai/docs/dev/getting-started/authentication

> Sign Hanzo Dev in to the Hanzo cloud.

## Authentication

Hanzo Dev ships pointed at `https://api.hanzo.ai/v1`, so signing it in is
signing in to Hanzo. There is nothing else to configure.

```bash
dev login
```

That opens [hanzo.id](https://hanzo.id) and stores the credential under
`~/.hanzo`. One account covers the whole toolchain — `hanzo auth login` signs
Dev in too, and this signs the CLI in — because they share that one file.

```bash
dev login status    # who you are
dev logout          # forget it
```

### A key instead of a person

For a machine, mint a key at **platform.hanzo.ai → API keys** and hand it over on
stdin, so it never lands in a file:

```bash
printenv HANZO_USER_KEY | dev login --with-api-key
```

Keep production keys in [KMS](https://docs.hanzo.ai/docs/openapi/kms) — never in source, never in a
committed `.env`.

### Environment

| Variable         | Description                                            |
| ---------------- | ------------------------------------------------------ |
| `HANZO_USER_KEY` | Your Hanzo key, read by the default `hanzo` provider   |
| `DEV_HOME`       | Config and session directory (default: `~/.hanzo/dev`) |

A `DEV_HOME` you set is its own island: it gets no shared credential, so sign in
again inside it.

Other model providers are configurable in `config.toml`, each declaring its own
`env_key`. The default provider is Hanzo and needs none of them.