# Sign-in and automation keys

For terminal use, run `evalrouter login` and approve sign-in in your browser. The CLI remembers your session and workspace. You do not need an API key. See [CLI sign-in](/developers/docs/cli-login).

## Workspace keys for CI and services

For CI or a service, [create an account](/register), verify your email, and create a [workspace API key](/settings/api-keys) with only the permissions it needs. A device sign-in can read the credit balance, but it cannot create keys, add credit, or change billing settings.

Set these through your secret manager or a private shell environment:

- `EVALROUTER_API_KEY`: the workspace key's secret value.
- `EVALROUTER_WORKSPACE_ID`: that workspace's ID.
- `EVALROUTER_BASE_URL`: `https://api.evalrouter.ai`, without `/v1`.

Keep credentials out of command arguments, URLs, source control, screenshots, and shared logs. A key belongs to its workspace, not to the person who created it, so it keeps working if they leave or change role. The API keys page shows who created each key and when it was last used; revoke keys you no longer need. To replace a key, roll it: you get a new key with the same permissions while the old one keeps working for up to seven days. You are emailed a week before a key expires, and a key found in public code is revoked automatically. A key grants only its workspace permissions. It does not add credit or make an unavailable evaluation runnable.

If a key fails, check its status and workspace before retrying. Do not start an evaluation to diagnose authentication. Continue with the [CLI quickstart](/developers/docs/quickstart).