# Authentication

The `mapbox auth` commands sign the CLI in to your Mapbox account and manage the token every other command uses. There are four:

-   [`mapbox auth login`](#mapbox-auth-login)
-   [`mapbox auth logout`](#mapbox-auth-logout)
-   [`mapbox auth refresh`](#mapbox-auth-refresh)
-   [`mapbox auth whoami`](#mapbox-auth-whoami)

All four commands also take `--profile <name>` — which credential file to act on, defaulting to `default`.

## `mapbox auth login`

Registers an OAuth client, opens the browser for the authorization code, and exchanges it for a token. Requires an interactive terminal and a browser; for scripts or CI, use `MAPBOX_ACCESS_TOKEN` instead.

**Examples:**

```sh
mapbox auth login                    # default profile
mapbox auth login --profile work     # a second account, side by side
```

## `mapbox auth logout`

Deletes the locally stored credentials file for the selected profile. This does not revoke the associated access or refresh token — the token can still be used until it expires.

**Examples:**

```sh
mapbox auth logout
mapbox auth logout --profile work -o json
```

## `mapbox auth refresh`

Forces a token refresh regardless of expiry.

**Examples:**

```sh
mapbox auth refresh
mapbox auth refresh --profile work
```

## `mapbox auth whoami`

Reports the token the *next* command will use and whose it is, without refreshing it.

**Parameters:**

| Parameter | Description |
| --- | --- |
| `--verify` | Confirm the token against the Mapbox API instead of only reading it locally — a revoked token still looks perfectly valid when read from disk. |

**Examples:**

```sh
mapbox auth whoami
mapbox auth whoami --profile work
mapbox auth whoami --verify
```