---
sidebar_position: 1
description: "Log in to a Gitea instance"
---

# gt auth login

<!-- Generated by update_cli_docs.sh from the gitea/cli sources, do not edit. -->

Log in to a Gitea instance

## Synopsis

```text
Log in to a Gitea instance. On a terminal without a method flag, gt asks for the instance,
how to log in, where to keep the token and whether git should use gt for the instance.

Create a token on the instance under Settings > Applications. Logging in to an account
that gt already has replaces its stored credential after a confirmation (or with --yes).
```

```
gt auth login [flags]
```

## Examples

```
$ gt auth login
$ gt auth login --host gitea.com --with-token < token.txt
$ gt auth login --host gitea.com --oauth --scopes read:repository,read:user
$ gt auth login --host gitea.example.com --with-token --header 'CF-Access-Client-Id: $CF_ID' --header 'CF-Access-Client-Secret: $CF_SECRET'
```

## Options

```
      --client-cert file                Present the PEM TLS client certificate in file to an instance that requires one; convert a PKCS#12 file with: openssl pkcs12 -in cert.p12 -clcerts -nokeys -out cert.pem
      --client-id ID                    OAuth application ID registered on the instance (default: the instance's stored ID, then gt's); implies --oauth
      --client-key file                 Unencrypted PEM private key file of --client-cert (default: the key in the --client-cert file); convert a PKCS#12 file with: openssl pkcs12 -in cert.p12 -nocerts -nodes -out key.pem
      --credential-store string         Where to keep the token {keyring|file} (default "keyring")
      --header "Name: value"            Send the "Name: value" header with every request to this instance, such as an access proxy needs; a value of $NAME or ${NAME} is read from that environment variable (repeatable)
  -h, --help                            help for login
      --insecure                        Skip TLS certificate verification for this instance
      --oauth                           Authorize in a web browser with OAuth
      --scopes scopes                   OAuth token scopes, such as read:repository (default: write access to everything but administration); implies --oauth
      --ssh-agent-key fingerprint       Sign requests with the ssh-agent key of fingerprint
      --ssh-agent-principal principal   Sign requests with the ssh-agent certificate of principal
      --ssh-key file                    Sign requests with the SSH private key in file
      --with-token                      Read an access token from stdin, or ask for it on a terminal
```

## Options inherited from parent commands

```
      --cwd directory       Working directory for repository discovery
      --debug               Log the method, URL, status, and duration of each HTTP request to stderr
      --host URL            Gitea instance URL, including any base path
      --interactive         Allow prompts with machine output
  -q, --jq expression       Filter JSON output using a jq expression; implies --json
      --json fields[="*"]   Output JSON with the specified comma-separated fields, or all fields
      --no-input            Disable prompts and implicit editor/browser interactions
      --remote remote       Git remote used for repository discovery
  -R, --repo OWNER/REPO     Select a repository as OWNER/REPO or URL
      --sudo user           Perform API requests as this user (requires an administrator account)
      --user name           Account name on the selected instance
  -y, --yes                 Accept confirmations without prompting
```

## SEE ALSO

* [gt auth](../auth/index.md): Authenticate gt and git with Gitea