Authentication
Choose browser login or a scoped API token for the CLI.
OutRay credentials identify the organization a tunnel belongs to. They do not authenticate visitors to the public tunnel URL.
Browser login
outray loginThe CLI opens an authorization page on https://outray.co, waits for approval, and asks you to select an organization. If the browser does not open, copy the authorization URL printed in your terminal.
The saved login is stored in ~/.outray/config.json. Treat that file as a credential: do not commit or share it. The CLI refreshes its organization token when needed.
Check or change your organization
outray whoami
outray switch
outray switch my-teamwhoami shows the active organization and your role for a saved browser login. switch changes that saved organization.
To use a different organization for one tunnel without changing your saved selection:
outray 3000 --org another-teamThe override requires a browser login that has access to that organization.
API tokens for automation
Open your organization's API tokens page at https://outray.co/<org-slug>/tokens. Create a token with Connect tunnels permission (tunnel:connect), and store the full value in a server-side secret store.
Pass the token explicitly:
outray 3000 --key "$OUTRAY_API_KEY"The single-tunnel CLI does not automatically read OUTRAY_API_KEY; the shell expands the variable into --key. A token already belongs to its organization, so --org does not change its scope.
Never place tokens in browser code, public configuration, screenshots, or committed files. Command-line arguments can be visible to other local processes; use a restricted automation runner and a narrowly scoped token.
Secrets and SDK credentials
Authentication differs by workflow:
| Workflow | Credential source |
|---|---|
| One HTTP, TCP, or UDP tunnel | Saved CLI login, or explicit --key |
outray start with TOML | Saved browser login |
outray secrets commands | OUTRAY_TOKEN, then OUTRAY_API_KEY, then saved login |
| Tunnel plugins | Explicit apiKey or OUTRAY_API_KEY; no saved-login fallback |
| Observability SDKs | Explicit apiKey or OUTRAY_API_KEY; require observability:write |
See Secrets and SDK setup for their permission requirements.
Sign out
outray logoutThis clears the saved local login. It does not revoke separately created API tokens. Revoke those in the API tokens page when no longer needed.