Most Lager Boxes need no sign-in — you run commands and they work. Some
boxes, though, sit behind an access gateway: an authenticating proxy
that only lets assigned users reach the box. Against one of those, Lager
asks you to sign in once, then authenticates every command automatically.
A plain Lager Box never prompts for this. You only see it when someone
deliberately places a box behind a gateway.
Signing in
The first time you run a command against a gated box, it tells you exactly
what to do. The message fills in the URL for you:
You’ll be asked for your account email and password (and an MFA code if
your account uses one). Your session is stored in ~/.lager_gateway_auth
(readable only by you) and refreshes on its own, so you rarely sign in more
than once. From then on, lager hello, lager python, net commands, and
everything else just work against that box.
Non-interactive sign-in
Both credentials can be supplied as options instead of being prompted for,
which is what you want in a CI job:
A password passed on the command line is visible to other users via the process
list and is written to your shell history. Read it from a secret store or an
environment variable, as above, rather than typing the literal value.
Checking your status
When something looks off, lager whoami is the first thing to run:
It shows four things:
- which servers you are signed in to
- who you are signed in as
- when each session expires
- which gated boxes the CLI saw
That separates three problems at a glance: “not signed in”, “signed in as the
wrong account”, and “signed in but no access”.
Common messages and what they mean
If you hit any of these on an old Lager version, upgrade first —
sign-in support needs a current CLI:
For administrators
Your control-plane dashboard, not the CLI, controls whether a box requires
sign-in and who can use it. Assign users to a box, then turn its
access guard on; denied attempts are logged so you can see who needs
access. 
