Authentication
The CLI, Python SDK and REST API authenticate with an API key. The Studio web app uses a secure browser session instead.
Create an API key#
Open Settings → API Keys. Choose a name, the scopes the key needs, an expiry date and an optional spending limit. Copy the key when it appears: Studio never shows it again.
Give each key only the scopes it needs:
| Scope | Allows |
|---|---|
read | Inspect gyms, plans, runs and usage. |
run | Create plans and start or cancel training runs. |
benchmark | Submit and inspect held-out evaluations. |
publish | Add qualified gyms to your organization's Environment Hub. |
deploy | Provision, activate and remove inference deployments. |
inference | Call your models through the GFT inference API. |
Sign in with the CLI#
export GFT_API_URL=https://studio.g-ftech.com
gft login
gft whoamigft login checks the key and saves it in ~/.config/gft/config.toml with user-only permissions (0600). The hidden prompt keeps the key out of your shell history.
| Command | What it does |
|---|---|
gft login | Check a key and save it locally. |
gft whoami | Show the current user and organization. |
gft doctor | Check API health and authentication. |
gft logout | Delete the saved key. This does not revoke the key on the server. |
Use a key in automation#
In scripts and CI, set the key as an environment variable instead of running gft login. It takes priority over the saved key:
export GFT_API_URL=https://studio.g-ftech.com
export GFT_API_KEY="<your key>"
gft --json whoamiThe Python SDK reads the same variables:
from gft_client import Client
with Client() as client:
print(client.me())For REST calls, send the key as a bearer token:
curl https://studio.g-ftech.com/v1/me -H "Authorization: Bearer $GFT_API_KEY"Keep keys in a secret manager, not in source code. Revoke a key on the API Keys page when you no longer need it.
Browser sessions#
The Studio web app keeps you signed in with an HttpOnly session cookie, not an API key. The sign-in page shows the methods enabled on your server, such as Google sign-in. Local development can enable a loopback-only account; production servers never allow it.