authenticate the CLI

Configure the identity that your terminal, CI runner or agent uses to submit Sorus jobs. You need the beta client, an account and access to the intended repository. For a guided first run, use the Cargo check tutorial.

sign in

For an interactive terminal:

1. Run cargo sorus login.
2. Open the printed approval page in your signed-in browser session and confirm the device code.
3. Run cargo sorus whoami and check the active identity.
4. Run cargo sorus onboarding status to confirm account and repository onboarding before submitting a job.

CI and agent credentials

For an unattended caller, obtain the scoped credential through your account’s credential-management process, then:

1. Put it in your CI or agent host’s secret mechanism.
2. Inject it as SORUS_TOKEN only into the process that calls Sorus. Alternatively, set SORUS_CREDENTIAL_FILE to the credential file and leave SORUS_TOKEN unset.
3. Use the default endpoint, https://app.lathe.run, or set SORUS_ENDPOINT to the endpoint specified during onboarding.
4. Run cargo sorus whoami in that environment to check the selected identity before enabling jobs.

Keep the caller credential out of source, logs and URLs. Do not pass it to a customer build; a build secret needs its own scope and support in the release.

scopes and attribution

Grant only the scopes the task needs: read, submit, settings, credentials or admin authority. Check them against the API reference. API callers send Authorization: Bearer <credential>.

Verify that actions are attributed to the intended user or agent:<name>. Use the agent setup guide for MCP and coding-agent configuration.

authentication failures

For exit 3, check whether the credential is missing, refused, expired, revoked or out of scope. Verify the endpoint, tenant and credential source.

Unset an unintended SORUS_TOKEN before using SORUS_CREDENTIAL_FILE. Re-authorise or rotate the credential through your account’s access process. Keep credentials out of support messages.