Authentication

The CLI needs to know which ProtoMap Server to upload to, and who you are there. Log in once with protomap login, or set two environment variables.

Log In

bash

protomap login --server=https://protomap.example.com

protomap login opens the platform in your browser to approve the login. Once approved, scans upload as you, and protomap mcp serve reads the graph as you.

On a computer without a browser, such as a VM over SSH, or with --no-open, it prints a code instead: open <server>/#/cli in a browser on any computer and enter it.

The login is a personal API key, kept in ~/.protomap/login.json and readable only by you. It can upload scans and read the graph, but cannot change settings or chat. It appears among your API keys, where you can revoke it.

Log Out

bash

protomap logout

Logging out forgets the server and revokes this computer’s key on it.

Environment Variables

In containers, CI, and other automation, set these instead of logging in:

Variable	Value
PROTOMAP_URL	Your server’s address, such as https://protomap.example.com.
PROTOMAP_API_KEY	An API key from Settings › API Keys.

bash

export PROTOMAP_URL=https://protomap.example.com PROTOMAP_API_KEY=<key>
protomap scan /path/to/repository

When both are set, they take precedence over the login.

A personal key acts as you, and also serves protomap mcp serve to an agent. An organization key, which Admins create for continuous integration, scans without a user: only scans that can join the shared graph count, and it cannot serve an agent.

To keep the login somewhere other than ~/.protomap, set PROTOMAP_DATA_DIR to another folder.