# Install and sign in

> Install the Vigilbase CLI with npm, run public tools without an account, and sign in to Vigilbase One for the other commands.

Source: https://docs.vigilbase.com/tools/cli/install-and-sign-in

The Vigilbase CLI, `@vigilbase/cli`, runs the public security tools, the Cloudflare Checkup and Vigilbase One commands from a terminal.

## Install

Node.js 20 or newer is required. The Cloudflare Checkup needs Node.js 22.18 or newer, because it runs Cloudflare's `cf` CLI under the same Node.

:::code-group
```bash filename=npm
npm install -g @vigilbase/cli
vigilbase help
```

```bash filename=pnpm
pnpm add -g @vigilbase/cli
vigilbase help
```

```bash filename=npx
npx @vigilbase/cli help
```
:::

Check which version answers with `vigilbase --version`.

## What needs a sign-in

| Works without signing in | Needs `vigilbase login` |
| --- | --- |
| `list`, `headers`, `email`, `run security-headers`, `run email-security`, `describe`, `skill`, `badge`, `doctor`, `cloudflare-checkup` | `run website-security`, `run react2shell`, `run fortibleed-check`, any `run … --via one`, and the Vigilbase One commands such as `account`, `runs`, `cf` and `security` |

Public scans never read your saved sign-in, so a broken or expired sign-in cannot make them fail.

## Sign in

```terminal
$ vigilbase login
```

The CLI opens your browser and waits while you approve a device code at `https://auth.vigilbase.com/device` and choose the organization the sign-in is for. On a remote terminal, run `vigilbase login --no-open` and open the printed URL in a browser where you are signed in.

Check the sign-in with `vigilbase whoami`, and sign out with `vigilbase logout`, which revokes the sign-in before deleting it.

To save an existing One session token instead, pipe it from your secret manager:

```bash
my-secret-tool read vigilbase-token | vigilbase login --token-stdin
```

`--token <bearer>` and `VIGILBASE_ONE_TOKEN` also work, but arguments can show up in process lists and shell history.

> [!WARNING]
> Signing in isn't supported on Windows yet, because the CLI cannot yet protect credential files there. `login` and the commands that need it stop with code `SIGN_IN_UNSUPPORTED`. Public tools, `doctor`, `describe`, `skill`, `badge` and `cloudflare-checkup` work on Windows.

## Where credentials are stored

Credentials are saved in the config directory: `VIGILBASE_CONFIG_DIR` if set, otherwise `$XDG_CONFIG_HOME/vigilbase`, otherwise `~/.config/vigilbase`. Files are written with mode `0600` in a directory with mode `0700`, and the CLI refuses a path that contains a symbolic link or that other users can write to. See [Troubleshooting](https://docs.vigilbase.com/tools/cli/troubleshooting) if you get one of these errors.

## Configuration

| Option | Environment variable | Default |
| --- | --- | --- |
| `--base-url <origin>` | `VIGILBASE_BASE_URL` | `https://vigilbase.com` |
| `--one-url <origin>` | `VIGILBASE_ONE_URL` | `https://one.vigilbase.com` |
| `--auth-url <origin>` | `VIGILBASE_AUTH_URL` | `https://auth.vigilbase.com` |
| `--timeout <ms>` | — | `60000` per request |

| Environment variable | Effect |
| --- | --- |
| `VIGILBASE_CLI_NO_OPEN=1` | Never open a browser |
| `VIGILBASE_CLI_NO_BANNER=1` | Hide the banner |
| `VIGILBASE_CLI_NO_PROGRESS=1` | Turn off progress animations |

Next, see [Commands](https://docs.vigilbase.com/tools/cli/commands).