Authenticate the Coolify CLI

The Coolify CLI authenticates through the Coolify REST API. Each request uses an API token associated with a saved context or supplied for one command with --token.

Treat API tokens as passwords

Use a separate, least-privilege token for each team and automation workflow. Do not commit tokens to a repository, paste them into shared logs, or store them in unprotected scripts.

Create an API token

Follow API Tokens to create a token for the active team. Select only the permissions required by the CLI commands you plan to run.

On self-hosted Coolify, an administrator must also enable API Access and allow the caller's source IP when an allowlist is configured. Read IP Allowlist for these instance settings.

Choose your Coolify deployment

Authenticate with Coolify Cloud

The CLI creates a cloud context for https://app.coolify.io when it creates the configuration file for the first time. Save your Cloud token, select the context, and verify it:

coolify context set-token cloud <api-token>
coolify context use cloud
coolify context verify

A successful verification reports that the connection and authentication are valid, followed by the Coolify version.

Override a saved token

The global --token <api-token> flag overrides the token saved in the selected context for one command:

coolify --context production --token <api-token> resource list

Prefer a saved context for interactive work. In automation, inject the override from the CI or orchestration platform's secret store rather than writing it directly in the command or configuration file.

Troubleshoot authentication

Run coolify context verify to test the selected URL and token together.
A 401 response usually means the token is missing, expired, revoked, or invalid.
A 403 response can mean the token lacks permission, self-hosted API access is disabled, or the caller does not match the IP allowlist.
If expected resources are missing, confirm that the token belongs to the team that owns them.

Read API authorization for the complete access checks. Follow Contexts to add, switch, update, or remove saved connections.