Skip to main content
Most Lager Boxes need no sign-in — you run commands and they work. Some boxes, though, sit behind an access gateway: an authenticating proxy that only lets assigned users reach the box. Against one of those, Lager asks you to sign in once, then authenticates every command automatically. A plain Lager box never prompts for this. You only ever see it when a box has been deliberately placed behind a gateway.

​
Signing in

The first time you run a command against a gated box, it tells you exactly what to do — the URL is filled in for you:
You’ll be asked for your account email and password (and an MFA code if your account uses one). Your session is stored in ~/.lager_gateway_auth (readable only by you) and refreshes on its own, so you rarely sign in more than once. From then on, lager hello, lager python, net commands, and everything else just work against that box.

​
Checking your status

When something looks off, lager whoami is the first thing to run:
It shows which servers you’re signed in to, as whom, when each session expires, and which gated boxes it has seen — enough to tell at a glance whether a problem is “not signed in”, “signed in as the wrong account”, or “signed in but no access”.

​
Common messages and what they mean

If you hit any of these on an old Lager version, upgrade first — sign-in support needs a current CLI:

​
For administrators

Whether a box requires sign-in, and who may use it, is managed from your control-plane dashboard, not the CLI. Assign users to a box, then turn its access guard on; denied attempts are logged so you can see who needs access.