---
description: >-
  The tofu login command can be used to automatically obtain and save an
  API token for any host that offers OpenTofu-compatible services.
---

# Command: login

The `tofu login` command can be used to automatically obtain and save an
API token for any host that offers OpenTofu-compatible services.

:::note
This command is suitable only for use in interactive scenarios
where it is possible to launch a web browser on the same host where OpenTofu
is running. If you are running OpenTofu in an unattended automation scenario,
you can
[configure credentials manually in the CLI configuration](../../cli/config/config-file.mdx#credentials).
:::

## Usage

Usage: `tofu login [hostname]`

## Credentials Storage

By default, OpenTofu will obtain an API token and save it in plain text in a
local CLI configuration file called `credentials.tfrc.json`. When you run
`tofu login`, it will explain specifically where it intends to save
the API token and give you a chance to cancel if the current configuration is
not as desired.

If you don't wish to store your API token in the default location, you can
optionally configure a
[credentials helper program](../../cli/config/config-file.mdx#credentials-helpers) which knows
how to store and later retrieve credentials in some other system, such as
your organization's existing secrets management system.

## Login Server Support

The `tofu login` command works with any server supporting the
[login protocol](../../internals/login-protocol.mdx).
