Moon CLI acts on your behalf with a session of its own for the terminal, which you can see and revoke at any time. You sign in through the browser, or with a code on a machine without a browser.
Sign in with the browserLink to the Sign in with the browser section
- Go to your project, then run
moon login. - The browser opens on Moon AI’s “Connect Moon CLI.” page. Sign in to your account if needed. If nothing opens, open the link shown in the terminal.
- Check the account shown under “Signed in as”, then click “Authorize”. “Deny” cancels the request.
- The page shows “Moon CLI connected”. In the terminal, Moon CLI confirms the sign-in and the agent starts in the current folder.
cd my-project
moon login- To sign in without starting the agent:
moon.login --no-launch - To avoid opening a browser on this machine:
moonprints the sign-in address; open it where your Moon AI account is signed in, within 5 minutes.login --no-open - The terminal waits 5 minutes for your answer. After that, the page shows “Moon CLI is no longer responding”: run
moon loginagain. - With Safari, if the terminal receives nothing, use the “My terminal is open but nothing happens (Safari). Send the code manually” link.
- The first time, running
moonwithout a session starts this same sign-in.
If none of your workspaces includes Moon CLI, the page says so (“Moon CLI is included with the Étoile plan and above. None of your workspaces has it yet.”) and offers “View plans”. It also flags a failed payment or an ended subscription.
Each time you sign in, Moon AI sends you the “New Moon CLI sign-in” email, with the device name, the time and an approximate location.
Sign in without a browserLink to the Sign in without a browser section
On a server, in an SSH session or in a container, use a device code:
moon login --deviceMoon CLI picks this mode on its own in an SSH session, or on Linux without a graphical display (except WSL). moon forces the browser.
- The terminal shows an address (
https://) and a code that looks likechat.realmoon.ai/ api/ v1/ auths/ cli/ device ABCD-EF23. - On any device, open the address, sign in to Moon AI, enter the code and click “Autoriser” (authorize).
- The “Autoriser cet appareil ?” (authorize this device?) page, in French, shows the device name (declared by the machine, not verified), its approximate IP address, the time of the request and the code. If it really is your machine, click “Autoriser cet appareil” (authorize this device); otherwise click “Refuser” (deny).
- The terminal confirms the sign-in. Then run
moonin your project.
The code is valid for 10 minutes.
Paste a tokenLink to the Paste a token section
moon login --token <token>With no value after --token, Moon CLI asks you to paste the token. It checks it with Moon AI before saving it. A website session token is refused with the message “Ce jeton n’est pas un jeton Moon CLI.” (this token is not a Moon CLI token).
Your account’s API key (“Settings” › “Account and security” › “API keys”) also works with Moon CLI, within your plan’s limit. Prefer signing in through the browser: the session then renews on its own and appears in your Moon CLI sessions.
To run without a terminal (continuous integration), see Task without the interface.
Where the token is storedLink to the Where the token is stored section
- The session tokens are stored in the system keychain: Credential Manager on Windows, Keychain on macOS, libsecret on Linux. The
auth.jsonfile in the state folder then only keeps the address, the email and the dates. - Without a keychain (Linux server without a graphical session, WSL, container), they are in
auth.json, readable by your account only. moon doctortells you where your token is.- The agent never sees the token: a local component of Moon CLI adds it to each request to Moon AI.
- The token is only ever sent to
https://. A session saved for another address is ignored.chat.realmoon.ai
Session lifetimeLink to the Session lifetime section
| Step | What happens |
|---|---|
| Sign-in | Moon CLI receives an access token valid for 24 hours and a single-use refresh token. |
| Less than 15 minutes before the access token expires | Moon CLI renews it without asking you anything, even in the middle of a long session: a new access token and a new refresh token, and the old ones stop working. |
| 90 days after signing in through the browser or with a code | Moon CLI asks you to sign in again through the browser. |
A session opened with Moon CLI 0.5.2 or an older version (30-day token) switches to short-lived tokens on its own the first time 0.5.3 starts.
If a refresh token that was already used is presented, for example by a copy of your session on another device, Moon AI closes the whole session and sends you the “Moon CLI session closed for safety” email. Sign in again with moon login. If the same session is renewed from two countries within 6 hours, you receive the “Moon CLI session used from two countries” email: the session stays open, since a VPN can explain it.
moon whoami shows when the access token expires and the number of days before you must sign in again. Several moon processes open at the same time share the same renewal.
Check the sign-in statusLink to the Check the sign-in status section
moon whoamiConnecté · vous@exemple.fr · jeton eyJh…k3Qw · valable jusqu’au 11/11/2026
Jeton d’accès d’un jour, renouvelé automatiquement.
Workspace · Studio · Étoile · ✦ accès Moon CLI actif
Reconnexion par le navigateur dans 84 jours.The output, in French, shows the account, a shortened token and its expiry date, that the one-day access token renews automatically, the workspace with its plan and Moon CLI access, and the number of days before you must sign in again through the browser. The token is never shown in full. If Moon AI refuses the session (expired or revoked), moon whoami tells you to run moon login.
See and revoke sessionsLink to the See and revoke sessions section
Each sign-in creates a Moon CLI session, named after the device (for example PC-ALICE ).
From the terminal:
moon sessions
moon sessions revoke 3f9a1cmoon lists your sessions with their ID, the device and the date; the current terminal’s session is marked “celle-ci” (this one). moon accepts the start of the ID if it matches only one session.
From the app:
- Open “Settings” › “Account and security” (chat.realmoon.ai/settings/account#security).
- In “Moon CLI sessions”, click “Revoke” next to the session, then confirm “Revoke this Moon CLI session?”.
The section only appears if you have at least one Moon CLI session.
These actions also close your Moon CLI sessions:
- “Sign out other devices”, in “Settings” › “Account and security”: every other browser, app and Moon CLI session.
- “Sign out from all devices” (“Sign out everywhere”): every device, this one included.
- Changing your password.
In a managed organization, an admin can also end a member’s Moon CLI sessions linked to the organization. See Account security.
Sign outLink to the Sign out section
moon logoutMoon CLI revokes the session with Moon AI, then erases the token from your machine. If Moon AI cannot be reached at that moment, the local token is erased anyway: in that case, revoke the session from “Settings” › “Account and security”.
If it does not workLink to the If it does not work section
- The browser does not open, or you are on SSH, in WSL or on a server: see Sign-in does not work.
- “Moon CLI requiert un abonnement Étoile ou supérieur” (Moon CLI requires an Étoile plan or higher): see Plan.
- Expired session or wrong account: see Expired or revoked token and The wrong account.