Skip to main content
The xpander CLI authenticates per profile and stores credentials at ~/.xpander/credentials. You can have multiple profiles for different organizations or environments (production, staging, …).

​
xpander login (alias l)

Authenticate via browser. Opens xpander.ai in your default browser, completes the OAuth flow, and writes credentials to the active profile.

​
xpander configure (alias c)

Set up API credentials manually (for environments without a browser, or when you already have an API key).
The wizard:
  1. Stores your API key in the profile.
  2. Validates against xpander.ai (unless --no-validate).
  3. Auto-detects your organization ID.
  4. Writes both to ~/.xpander/credentials.
Output:

​
xpander profile

Manage profiles.
Use --profile <name> on any command to override the active profile for a single call:

​
xpander secrets-sync

Upload your local .env variables to deployed agents as runtime secrets.
This reads .env in the current directory and uploads each KEY=value line to the deployed agent’s secret store. Existing secrets with the same key are overwritten. Use this after xpander agent deploy whenever you change environment-dependent config without rebuilding the container: for example, rotating an external API key.

​
Auth priority

When multiple credential sources are present, the CLI resolves auth in this order:
  1. --api-key on the command line.
  2. XPANDER_API_KEY environment variable.
  3. ~/.xpander/credentials (the active profile).
This lets CI runners override the local profile without touching it.

​
Files and locations