OverviewInstallFirst commandAuthenticateInject secretsUse in CI/CDTerminal UIExport dotenvGenerate TOTPCommandsTroubleshooting
GETTING STARTEDGuide

Authenticate the CLI

Sign in once through the browser. The CLI keeps the session securely on your system and uses the team you approved.

Browser login

bash
$ movitera login
✓ Logged in as token movitera-cli @ workstation (expires 2026-08-21).
Stored in macOS Keychain.
Default team set to Acme IT.

movitera login opens the Movitera authorization screen in your browser. After you approve, the CLI finishes the login on its own, keeps the session securely on your system, and sets the approved team as the default.

What you approve in the browser

The Autorizar (Authorize) screen shows the name and version of the client requesting access to your Movitera vault. Approving creates a personal access token, which you can revoke at any time in Tokens de acesso. Before you click Autorizar, check the three fields:

  • Time (team) — the team whose vault the CLI will access. Only teams where you have Vault access appear.
  • Nome do token (token name) — pre-filled with the client and machine name. This is how the token appears later in the Tokens de acesso list.
  • Expira em (expires in) — 7 dias (7 days), 30 dias, 90 dias, or 1 ano (1 year). The Nunca expira (never expires) option appears only for Vault managers on the selected team.

Approving requires recent two-factor authentication: when needed, the confirmation opens automatically and the authorization continues after it. On success, the screen shows Autorizado (authorized), the tab can be closed, and the terminal finishes the login.

The request expires in 5 minutes

Each movitera login creates a request valid for 5 minutes. If the screen shows Esta solicitação de login expirou (this login request has expired), return to the terminal and run movitera login again.

If the screen shows an error

MessageWhat to do
Esta solicitação de login expirou (this login request has expired)You took more than 5 minutes to approve. Run movitera login again and approve the new request.
Esta solicitação já foi processada (this request has already been processed)The link was already used or cancelled. Start a new login from the CLI.
Solicitação de login não encontrada (login request not found)The link is no longer valid. Start a new login from the CLI.
Você não tem acesso ao cofre (you don't have vault access)You need a Vault role on the selected team. Ask the team admin, then try again.
Autenticação de dois fatores cancelada. Tente novamente. (two-factor authentication cancelled — try again)Click Autorizar again and complete the two-factor confirmation.

Authenticate in CI/CD

A server or pipeline has no browser. Create a token in Tokens de acesso in the web app and use it to authenticate without an interactive login.

Running in CI/CD?

See Use in CI/CD to authenticate in your pipeline and run movitera run with Vault secrets.

Logout

bash
$ movitera logout
✓ Stored token removed.

movitera logout removes the session from this machine only. To cut access from anywhere — a lost laptop, for example — revoke the token in Tokens de acesso. Any CLI using that token stops working immediately.

Next

Use in CI/CDTroubleshooting