Cloud Credentials

Cloud credentials authenticate your CLI and API requests to systemprompt.io Cloud. They're stored in .systemprompt/credentials.json and expire when the embedded JWT expires.

How It Works

When you run just login (which wraps systemprompt cloud auth login), systemprompt.io opens your browser for OAuth authentication. After successful login, credentials are saved locally.

just login
    │
    └── Opens browser for OAuth
            │
            └── Saves credentials.json
                    │
                    └── Valid until the JWT expires

credentials.json Structure

{
  "api_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "api_url": "https://api.systemprompt.io",
  "authenticated_at": "2026-02-01T10:00:00Z",
  "user_email": "user@example.com"
}

Field	Description
api_token	JWT token for API authentication
api_url	Cloud API endpoint
authenticated_at	Login timestamp
user_email	User's email address

Token Expiration

The expiry is embedded in the JWT itself. The CLI warns when the token expires within an hour. When expired:

1. CLI commands return authentication errors
2. Run just login to re-authenticate
3. New credentials.json is created

File Locations

Credential paths are fixed relative to the profile directory. From .systemprompt/profiles/<name>/, the CLI resolves ../../credentials.json and ../../tenants.json, so both files live directly under .systemprompt/. They are not configurable in profile.yaml.

Container Deployment

In container deployments, credentials load from environment variables:

Environment Variable	Description
SYSTEMPROMPT_API_TOKEN	API token (required)
SYSTEMPROMPT_USER_EMAIL	User email (required)
SYSTEMPROMPT_API_URL	API endpoint (optional)

Commands

Task	Command
Login	just login
Check auth	systemprompt cloud auth whoami
Logout	just logout

Security

• Never commit credentials.json to git
• File should have 0600 permissions (owner read/write only)
• To revoke a token, contact ed@systemprompt.io

See systemprompt cloud --help for detailed CLI options.