auth

Personal authentication to CARTO. Manage login sessions, named profiles, and view current user information.

For an overview of the OAuth flow, profiles, and re-authentication behavior, see Authentication & profiles.

carto auth login [profile]

Open a browser-based OAuth 2.0 + PKCE login flow and store the resulting credentials.

carto auth login                              # Login to default profile
carto auth login staging                      # Login to a named profile
carto auth login --organization-name "ACME"   # Organization-specific login (SSO or standard)
carto auth login acme-prod --organization-name "ACME Corporation"

Arguments:

• [profile] — Optional profile name. If omitted, an auto-generated name tenant_id/org_name/[e-mail] is used.

Options:

Option	Description
--env <environment>	Auth environment: production, staging, local, dedicated-NN. Only set if instructed by support.
--organization-name <name>	Organization name for SSO login. Use quotes if it contains spaces.
--organization-id <id>	Organization ID for SSO login (future support).

carto auth logout [profile]

Remove stored credentials.

carto auth logout                   # Logout from default profile
carto auth logout staging           # Logout from named profile

carto auth status [profile]

Show authentication status, token expiration, and the full tenant → organization → user hierarchy. With no arguments, also lists every available profile and marks the current default.

carto auth status
carto auth status production

carto auth use <profile>

Set the given profile as the current default. Subsequent commands will use it unless overridden by --profile or CARTO_PROFILE.

carto auth use production

carto auth whoami

Show the authenticated user's profile (user ID, name, email, account info, roles).

carto auth whoami

On an M2M profile there is no user profile to show, so whoami reports the service identity instead: client id, account id, the user the client acts on behalf of, API base URL and token expiry. API access tokens created from an M2M session are attributed to that acting user.