> ## Documentation Index
> Fetch the complete documentation index at: https://developers.parkes.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and profiles

> Choose an API profile, authorize an organization, and keep credentials secure.

## Create a profile

A fresh installation has no profile. Check existing profiles before creating one:

```bash theme={null}
parkes config profiles list --output json
parkes config profiles create production --host https://api.parkes.ai
```

Use the API origin as `--host`, without `/rest/v1`. The first profile becomes active. Creating another profile does not switch the active one.

## Sign in

```bash theme={null}
parkes --profile production auth login
parkes --profile production auth status --output json
```

Complete the browser sign-in and choose an organization. Check the identity returned by `auth status` before making changes. `auth whoami` also retrieves your identity.

Use `--reauth` when fresh browser authentication is required. To request a narrower set of scopes, pass `--scope` for each scope you need; check `parkes auth login --help` for the defaults.

## Use a remote shell

```bash theme={null}
parkes --profile production auth login --device --no-browser
```

Open the printed URL on a device with a browser and complete the authorization. The CLI waits for completion. `--no-browser` alone keeps the regular login flow and prints its URL instead of opening a browser.

## Work across organizations

Every grant belongs to **one organization**. Authorize each organization separately. A profile can remember its organization and select a cached account for it.

For a second organization, create another profile and sign in to it:

```bash theme={null}
parkes config profiles create second_org --host https://api.parkes.ai
parkes --profile second_org auth login
parkes --profile second_org auth status --output json
```

Select a profile for one command with `--profile`, or change the active profile explicitly:

```bash theme={null}
parkes config profiles use second_org
```

`--org ORGANIZATION_UUID` and `parkes organizations use ORGANIZATION_UUID` select context for an already authorized organization. They cannot expand a token's access. If you supply a token for a different organization, the CLI rejects the mismatch.

## Scripts and unattended access

Supply a personal token through `PARKES_TOKEN`, using your secret manager or runner's secret environment. This overrides the credential store for API requests. You still need a profile for the API host.

Personal tokens retain their scopes and organization restrictions. They can write Knowledge only in your own namespace. See [API authentication](https://developers.parkes.ai/AUTHENTICATION.md) for credential management.

`parkes auth tokens create` requires recent first-party browser authorization and a new `--output-file` destination. It writes the secret to that file, not stdout. A lost issuance secret cannot be recovered by replaying the request; revoke it and issue another.

## Credential storage

Login and refresh credentials use the OS credential store. Profile configuration contains nonsecret host and identity information. If the credential store is unavailable, the CLI requires an explicitly supplied environment token; there is no plaintext token-file fallback.

If a refresh request is interrupted and its outcome is uncertain, sign in again. Do not repeatedly replay a rotating refresh token.

## Sign out

```bash theme={null}
parkes --profile production auth logout
```

This revokes the selected authorization and removes its stored credential. Use `parkes auth logout --all` to visit all cached accounts.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.