Sign in and Ask Glob

Signing in enables commands that need your Colli account, including Ask Glob and API key management. Local note and task commands work without signing in. Sync also needs a separate sync passphrase; your account password and that passphrase serve different purposes.

On Linux, choose the dynamic x86_64 build for HTTPS commands. The default static Linux build cannot use hosted sign-in, Ask Glob or HTTPS sync successfully. See installation.

Set the account service#

glob server set https://api.colli.dev
glob server show

The saved server is used unless GLOB_SERVER_URL overrides it. Use glob config show to see which source is active. See configuration if a command reaches a different server than expected.

Sign in with email and password#

glob login --email [email protected]

In an interactive terminal, the CLI prompts for Password. This prompt reads a normal terminal line; it does not turn off terminal echo. Use browser sign-in if you want to avoid typing your password into that prompt.

For input supplied by a password manager or another protected input source, use:

glob login --email [email protected] --password-stdin

This reads one line from standard input. With --json, supply --password-stdin because the CLI does not prompt interactively in JSON mode.

If your account has no public username, the CLI asks for Public username. Supply --public-username <name> to avoid that prompt, especially in scripts:

glob login --email [email protected] --password-stdin --public-username example-reader --json

A human username must be nonempty and must not end in -AI, in any letter case. That ending is reserved for API key identities. The account service applies its own username rules as well. If your account already has a username, this option does not rename it during password or browser sign-in.

A successful response stores the session and reports authenticated, server, email and public_username. The JSON authenticated value is the string "true".

Sign in in a browser#

glob login --web

The CLI prints a URL and attempts to open it in your browser. Finish the account sign-in there, then return to the terminal when the browser says You're signed in — return to the terminal. If opening the browser fails, open the printed URL yourself.

Run this on the computer where the browser can return to the CLI. The browser flow waits for a callback on that same computer. It times out after five minutes with timed out waiting for browser sign-in (5 minutes); start again to get a new sign-in URL.

The portal defaults to https://account.colli.dev. --portal <https-url> overrides GLOB_ACCOUNT_URL, which overrides that default. A portal URL must use HTTPS. --public-username and --json are also accepted.

Browser sign-in prints its opening instructions even with --json, so its stdout is not a single JSON document. Use a different sign-in method for automation that expects only JSON.

Sign in with an existing session token#

glob login --stdin

Supply one line containing an account session token on stdin. The CLI checks it with the account service before saving it. It does not accept a scoped Data API key as a replacement for your account session.

--token <value> is also accepted. Prefer stdin because command arguments can appear in shell history and process listings. If both --stdin and --token are present, stdin takes precedence.

The token path does not prompt for a missing username unless you explicitly supply --public-username. Its successful JSON contains string authenticated: "true", server, and public_username when set through this invocation.

All login flags#

--web cannot be mixed with token or password sign-in flags. --email cannot be mixed with --token or --stdin. --password-stdin without --email is rejected. login has no --store option: the stored account session is shared by this user's CLI commands.

Check the session and sign out#

glob status --json
glob keys list
glob logout

status reports whether it can read a stored session; it does not contact the service to validate that session. keys list is a read-only account request that can reveal an expired or revoked session.

On macOS the CLI stores the session in Keychain. On Linux it writes a credential file; configuration explains its location and overrides.

glob logout [--json] removes the stored session. It reports logged out, or no session was stored when there was none. JSON contains { "authenticated": "false" }. This command removes the local credential rather than making an account-wide sign-out request.

Ask Glob#

glob ask "Suggest a packing checklist for a wet weekend."
glob ask "Rewrite this sentence more clearly: Bring all the things." --json

glob ask <prompt> sends one prompt to hosted Ask Glob. It is a one-shot question: the CLI does not attach your notes or tasks, search your store, or keep a conversation history for the next invocation. Include the text you want it to use in the prompt.

The command accepts --model <id> and --json, plus help. The default model ID submitted by the CLI is glob-gpt-4o-mini. The service decides which models are accepted for this operation; specifying an ID does not guarantee that it can be used. There is no CLI option for a provider key, temperature, streaming, or maximum response length.

Human mode prints the answer. In an interactive terminal it also prints the returned model and any reported credit charge. When piped, it prints the answer without that extra line. JSON data contains answer, model and, when supplied by the service, credits_charged.

For account and credit details, see the account credit guide and pricing.

Sign-in and AI failures#

For other failures and exact exit-code meanings, see troubleshooting and output.