---
canonical: "https://agi-labo.com/en/tools/cockpit/docs/cockpit-cli/reference/account"
title: "cockpit account"
description: "Generated reference for cockpit account, including its syntax, options, results, and constraints from the canonical cockpit CLI source."
section: "Reference"
order: 130
pageType: reference
lastVerifiedVersion: 4.61.0
lastVerifiedAt: "2026-08-27"
draft: false
surfaces:
  - cli
operatingSystems:
  - windows
  - macos
  - linux
plans:
  - guest
  - member
navigation: false
---

This reference is generated from the same canonical source distributed as cockpit CLI help. See [Cockpit CLI](/en/tools/cockpit/docs/cockpit-cli) for concepts and safe operating guidance.

Read, start, or end AGI Cockpit's sign-in to its AGI Lab account: the sign-in in the account menu that unlocks Autorun and the other member features. To sign in to an agent such as Claude or Codex, use `cockpit accounts`.

```bash
cockpit account status
cockpit account login [--print-url]
cockpit account logout
```

Every command returns JSON and is local-only; `--host` returns `host_not_supported`. No command returns a token.

`status` returns:

```json
{"ok": true, "data": {"signedIn": true, "member": true, "refreshRequired": false, "notice": null, "email": "y***@example.com", "expiresAt": null, "lastCheckedAt": "2026-11-07T01:30:00.000Z", "reason": null}}
```

- `signedIn`: a sign-in is saved on this computer.
- `member`: `true` when the last check found an active membership, `false` when it found none, and `null` before a check or when the check could not finish.
- `refreshRequired`: the sign-in expired or was revoked and has to be done again. Autorun skips its runs until then.
- `notice`: `required` (the same as `refreshRequired`), `expiring` (AGI Lab reported that the sign-in expires within 3 days), or `null`.
- `email`: the signed-in address with most of its local part hidden, or `null`.
- `expiresAt`: when the sign-in expires, once AGI Lab reports it; `null` until then.
- `lastCheckedAt` and `reason`: when AGI Cockpit last checked with AGI Lab and, when that check did not pass, why: `authentication-required`, `membership-required`, or `verification-unavailable`.

`status` asks AGI Lab again when the last passing check is more than five minutes old.

`login` starts the same browser sign-in as Sign in in the account menu and opens the authorization page in the system browser. A person approves it there; when the browser is already signed in to AGI Lab, that is one click. The command returns `{"started": true, "opened": true}` once the page is open, not when the sign-in completes, so run `status` afterwards. `--print-url` opens nothing and returns `{"started": true, "opened": false, "authorizeUrl": "…"}` for opening the page by hand on this computer. Only the AGI Cockpit that started the sign-in can finish it, within 30 minutes; starting again replaces the earlier page. Starting while signed in is allowed and replaces the sign-in when it completes.

`logout` signs out the same way as Sign out in the account menu and returns `{"signedOut": true, "wasSignedIn": <boolean>}`.

Errors: `not_allowed_for_crew` (below), `browser_open_failed` (use `--print-url`), and `sign_in_unavailable` or `sign_out_failed` when secure storage cannot be written.

A Crew's session may run `status` in any turn. `login` and `logout` work only in a turn that the owner's own message started; other turns, and the child tasks of a Crew, get `not_allowed_for_crew`. The agent of an ordinary task, one that belongs to no Crew, can run `login` and `logout`; its approval mode decides whether it may. A call that names a task or a Crew but cannot prove it with that task's secret also gets `not_allowed_for_crew`. These limits rest on the identity AGI Cockpit gives each session: a call that drops it cannot be told apart from the owner's own shell, so on this computer they guard against mistakes, not against a process that removes its identity on purpose. Even when a sign-in is started, a person approves it in the browser.

When a check finds that the sign-in expired, AGI Cockpit shows one desktop notification, a banner with a Sign in button at the top of the window, and `"signIn": {"state": "required", "expiresAt": …}` in `cockpit crew check`. Once AGI Lab reports when the sign-in expires, it does the same three days before with `"state": "expiring"`. Each state notifies once. Signing in again clears the banner and `signIn`, and the next expiry notifies again.

Each rejected membership check (HTTP 401) and each failed sign-in renewal is recorded in `~/.agi-tools/data/cockpit/logs/auth-session.jsonl` with the time, the HTTP status, and the kind of failure, such as `invalid_grant` or `timeout`. Tokens and e-mail addresses are never written there.