Skip to main content
The CLI authenticates through device authorization. When you run ek login, the CLI shows a verification code and a link that you can open on any device, like your laptop or phone. Because the login does not depend on a browser running on the same machine, it works over SSH, inside Docker containers and on any headless server.

​
How device login works

1

Start the login

The CLI prints a verification code and an authentication URL:
On your own machine the browser opens automatically. On a server or in a container it cannot, so copy the URL instead.
2

Approve on another device

Open the URL in a browser on any device and sign in to Enkryptify if you are not already. Check that the code on the page matches the code in your terminal, then click Approve.
3

Done

The CLI detects the approval within a few seconds and stores your credentials on the machine where you ran ek login.
The verification code expires after 5 minutes. If you miss the window, run ek login again to get a new code.

​
Logging in on a server

Over SSH the flow is exactly the same. Run ek login on the server, open the authentication URL in the browser on your own machine and approve. Then configure and run as usual:
Commit a .enkryptify.json file to your repository and you can skip ek setup entirely.

​
Using the CLI in Docker

Install the CLI in your image and use ek run as the entrypoint so secrets are injected when the container starts:
Dockerfile
Log in once with an interactive container, then start your app. Mount a volume for ~/.enkryptify so the credentials survive container restarts:
The first command prints the verification code and URL. Approve it in your browser and the container exits once the login completes. Every container that mounts the same volume is now authenticated.

​
Where credentials are stored

On a desktop machine the CLI stores credentials in the operating system’s credential store. Containers and minimal servers usually do not have one, so the CLI falls back to a protected file at ~/.enkryptify/secure-store.json, readable only by your user. To store credentials somewhere else, for example on a mounted volume, set ENKRYPTIFY_STORE_PATH:
A login session is valid for 8 hours. ek run injects secrets when your process starts, so a running process is not affected when the session expires. If a container restarts after the session has expired, ek run fails with an authentication error and you need to run ek login again.