Sign in
Approve a key for one website in your browser — the CLI never asks for your password.
The usual way: approve in the browser
webmati login --web --platform webmati
- The CLI prints a link and opens your browser (
Approve this machine in the browser). If you are not signed in to the admin, sign in first; you come back to this page afterwards. - The allow the CLI page shows your machine's name and the website the key is for. If you did not name one, the page lets you pick one of the websites of the workspace you have open (for a website in another workspace, switch workspace in the top bar first).
- Press Cho phép (Allow; the page is in Vietnamese, Huỷ is Cancel). The
key goes straight to the CLI over
127.0.0.1on your machine — never in a URL, never shown on screen. The CLI checks it and saves it to~/.config/webmati/credentials.json(readable by your account only).
The CLI waits up to 5 minutes.
Chrome asks about your local network
Chrome (and browsers built on it) may ask for permission to reach devices on your local network when the page hands the key to the CLI. Choose Allow: the "device" is the CLI waiting on your own machine (
127.0.0.1). If you block it, the page reports an error and revokes the key it just made; runloginagain.
What the key can and cannot do
The key carries your own permissions on this website, as the MCP does: themes, pages, the blog, images, products, orders, languages, the website's settings, the backend, domains, backups, analytics… What your role lacks, the key lacks; lose a permission or leave the workspace and the key loses it too.
| Can | Cannot |
|---|---|
| everything your account can do on this website | any other website, even one you can open |
| report and +1 platform issues, under your name | anything of the whole workspace: creating or deleting websites, members, API keys, billing |
A key made before 2026-10-12 carries a fixed list of scopes instead: such a call
is refused with missing scope: … — run webmati login --web once more.
A call refused with permission denied: … means your own account lacks that
permission on the website: the workspace owner can add it to your role.
The key expires after 30 days (the admin's default). Choose with --days
(1–90):
webmati login --web --platform webmati --days 7
Revoke a key at any time in the admin under Settings ▸ API Keys (CLI keys are
named webmati-cli@<machine name>).
Name the website: --store
Skip the picker by naming the website (slug or id):
webmati login --web --platform webmati --store my-shop
Inside a project, login --web needs neither --store nor --platform: it reads
both from webmati.toml.
Use a key you already have: --key
For a CI server, or with no browser at hand, use a key created in the admin (Settings ▸ API Keys). Pass it on stdin so it does not stay in your shell history:
webmati login --key - --platform webmati --store my-shop
Paste the key and press Enter. A workspace key opens every website of the
workspace, so name the one with --store. In CI, set the environment variable
WEBMATI_TOKEN instead of running login: it always takes precedence over a
saved key.
Sign out
webmati logout # inside a project: forget this website's key
webmati logout --platform webmati --store 42 # outside one: name the website (id)
logout only removes the key from this machine. The key stays valid until it
expires or is revoked in the admin.
Other platforms
--platform webmati fills in the API and admin addresses. For a server of your
own, give them:
webmati login --web --api https://example.com/graphql --admin https://example.com