auth

Authenticate with Sentry

Commands

sentry auth login

Authenticate with Sentry

Options:

Option	Description
--token <token>	Authenticate using an API token instead of OAuth
--timeout <timeout>	Timeout for OAuth flow in seconds (default: 900)
--force	Re-authenticate without prompting
--url <url>	Sentry instance URL to authenticate against (e.g. https://sentry.example.com). Required for self-hosted; defaults to SaaS (https://sentry.io).

sentry auth logout

Log out of Sentry

sentry auth refresh

Refresh your authentication token

Options:

Option	Description
--force	Force refresh even if token is still valid

sentry auth status

View authentication status

Options:

Option	Description
--show-token	Show the stored token (masked by default)
-f, --fresh	Bypass cache, re-detect projects, and fetch fresh data

sentry auth token

Print the stored authentication token

sentry auth whoami

Show the currently authenticated identity

Options:

Option	Description
-f, --fresh	Bypass cache, re-detect projects, and fetch fresh data

All commands support --json for machine-readable output and --fields to select specific JSON fields.

Examples

OAuth login (recommended)

sentry auth login

1. A URL and device code will be displayed
2. Open the URL in your browser
3. Enter the code when prompted
4. Authorize the application
5. The CLI automatically receives your token

Token login

sentry auth login --token YOUR_SENTRY_API_TOKEN

Self-hosted Sentry

The --url flag is required when first connecting to a self-hosted instance. This registers the host as trusted so subsequent commands don't need the flag:

# OAuth login to a self-hosted instance (requires --url on first use)
sentry auth login --url https://sentry.example.com

# Token-based auth with self-hosted
sentry auth login --token YOUR_TOKEN --url https://sentry.example.com

See Self-Hosted Sentry for details.

Re-authenticate and timeouts

# Force re-authentication (skip "already logged in" prompt)
sentry auth login --force

# Set a custom timeout for the OAuth flow (default: 900 seconds)
sentry auth login --timeout 300

Logout

sentry auth logout

Refresh token

sentry auth refresh

Print stored token

sentry auth token

Check auth status

sentry auth status

Authenticated as: username
Organization: my-org
Token expires: 2024-12-31

# Show the raw token
sentry auth status --show-token

# View current user
sentry auth whoami

Credential Storage

Auth tokens are stored in a SQLite database at ~/.sentry/cli.db with restricted file permissions.

Token Precedence

By default, the CLI checks for auth tokens in the following order:

1. The stored OAuth token in the SQLite database (from sentry auth login)
2. SENTRY_AUTH_TOKEN environment variable
3. SENTRY_TOKEN environment variable (legacy alias)

The stored OAuth token takes priority because it supports automatic refresh. To override this and force environment tokens to win, set SENTRY_FORCE_ENV_TOKEN=1.

When a token comes from an environment variable, the CLI skips expiry checks and automatic refresh.