# cs login (/docs/cli/login)

`cs login` opens your browser to CoreSpeed's sign-in, completes OAuth 2.1 with
PKCE against a loopback callback on `127.0.0.1`, and stores the tokens under
`~/.config/cs`. The result is a **member session** — the same principal as
browser sign-in from an agent — so everything a signed-in member may do,
including the session-gated `manage__*` tools, is available to the CLI. See
[Authentication](/docs/authentication).

## Usage \[#usage]

```bash
cs login   # opens the browser; prints the URL to visit if it cannot
```

## What happens \[#what-happens]

* Every sign-in ends by provisioning your account and prints
  `Provisioned org: <id> (created=true|false)`; `created=true` means this
  sign-in created the organization.
* The access token lives five minutes. Every other command refreshes it
  silently, so you sign in once per machine, not once per command.
* Until you sign in, every other command fails with
  `Error: not logged in; run cs login`.

## Environment variables \[#environment-variables]

Sign-in waits five minutes for the browser (`CS_LOGIN_TIMEOUT_MS`), listens on
a random loopback port (`CS_LOGIN_PORT` pins one), and stores tokens in
`CS_CONFIG_DIR`. Pointing the CLI at another environment means signing in again
there — see the [environment variables](/docs/cli#environment-variables).