> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enkryptify.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Docker and Servers

The CLI authenticates through device authorization. When you run `ek login`, the CLI shows a verification code and a link that you can open on any device, like your laptop or phone. Because the login does not depend on a browser running on the same machine, it works over SSH, inside Docker containers and on any headless server.

## How device login works

<Steps>
  <Step title="Start the login">
    ```bash theme={"dark"}
    ek login
    ```

    The CLI prints a verification code and an authentication URL:

    ```text theme={"dark"}
    Verification code: 3F2A8-91BC4
    Authentication URL: https://app.enkryptify.com/oauth/device?user_code=3F2A8-91BC4
    ```

    On your own machine the browser opens automatically. On a server or in a container it cannot, so copy the URL instead.
  </Step>

  <Step title="Approve on another device">
    Open the URL in a browser on any device and sign in to Enkryptify if you are not already. Check that the code on the page matches the code in your terminal, then click **Approve**.
  </Step>

  <Step title="Done">
    The CLI detects the approval within a few seconds and stores your credentials on the machine where you ran `ek login`.
  </Step>
</Steps>

<Note>
  The verification code expires after 5 minutes. If you miss the window, run `ek login` again to get a new code.
</Note>

## Logging in on a server

Over SSH the flow is exactly the same. Run `ek login` on the server, open the authentication URL in the browser on your own machine and approve. Then configure and run as usual:

```bash theme={"dark"}
ek login
ek setup
ek run -- node server.js
```

<Tip>
  Commit a [.enkryptify.json](/cli/commands#project-configuration-file) file to your repository and you can skip `ek setup` entirely.
</Tip>

## Using the CLI in Docker

Install the CLI in your image and use `ek run` as the entrypoint so secrets are injected when the container starts:

```dockerfile Dockerfile theme={"dark"}
FROM node:22-slim

RUN apt-get update && apt-get install -y curl sudo && rm -rf /var/lib/apt/lists/*
RUN curl -fsSL https://raw.githubusercontent.com/Enkryptify/cli/refs/heads/main/install.sh | bash

WORKDIR /app
COPY . .
RUN npm ci

CMD ["ek", "run", "--", "node", "server.js"]
```

Log in once with an interactive container, then start your app. Mount a volume for `~/.enkryptify` so the credentials survive container restarts:

```bash theme={"dark"}
docker run -it -v enkryptify:/root/.enkryptify my-app ek login
docker run -v enkryptify:/root/.enkryptify my-app
```

The first command prints the verification code and URL. Approve it in your browser and the container exits once the login completes. Every container that mounts the same volume is now authenticated.

### Where credentials are stored

On a desktop machine the CLI stores credentials in the operating system's credential store. Containers and minimal servers usually do not have one, so the CLI falls back to a protected file at `~/.enkryptify/secure-store.json`, readable only by your user.

To store credentials somewhere else, for example on a mounted volume, set `ENKRYPTIFY_STORE_PATH`:

```bash theme={"dark"}
ENKRYPTIFY_STORE_PATH=/data/enkryptify/secure-store.json ek login
```

<Note>
  A login session is valid for 8 hours. `ek run` injects secrets when your process starts, so a running process is not affected when the session expires. If a container restarts after the session has expired, `ek run` fails with an authentication error and you need to run `ek login` again.
</Note>