**Source URL:** https://limited.veevavault.dev/vault-dx/dx-reference/command-reference/login

Authenticate to a Vault and manage stored credentials.

## vault login

Authenticate to a Vault. Without credential flags, opens a browser window for SSO login. With `--access-token`, `--session-id`, or `--password`, authenticates directly without a browser.

### Usage

```sh
vault login [--dns <DNS>] [--username <USERNAME>] [--access-token] [--session-id] [--password]
```

### Options

| Option | Type | Required | Description |
| --- | --- | --- | --- |
| `--dns <DNS>` | string | Required for `--access-token`, `--session-id`, and `--password` | Vault DNS (for example, `myorg.veevavault.com`) |
| `--username <USERNAME>` | string | Optional | Username or email. Seeds the SSO login form, or the username for basic auth |
| `--access-token` | flag | Optional | Log in with an API access token. The token is read from a hidden prompt or piped stdin |
| `--session-id` | flag | Optional | Store a pre-existing session ID. The value is read from a hidden prompt or piped stdin |
| `--password` | flag | Optional | Log in with a username and password. The password is read from a hidden prompt or piped stdin |

This command also accepts the [global options](/vault-dx/vault-dx/vault-dx/dx-reference/command-reference/global-options/).

### Examples

#### SSO login (default)

```sh
vault login --dns myorg.veevavault.com
```

#### Access token (headless)

```sh
vault login --dns myorg.veevavault.com --access-token
```

The CLI prompts for the token with echo disabled.

#### Username & password

```sh
vault login --dns myorg.veevavault.com --username user@example.com --password
```

The CLI prompts for the password with echo disabled.

---

## vault logout

End the active session on the Vault side and remove stored local credentials and session token.

### Usage

```sh
vault logout [<DNS>] [--all]
```

### Options

| Option | Type | Required | Description |
| --- | --- | --- | --- |
| `<DNS>` | string | Optional | Vault DNS to log out of. If omitted, logs out of the active vault |
| `--all` | flag | Optional | Log out of every stored vault |

---

**Previous:** [Global Options](/vault-dx/dx-reference/command-reference/global-options)  
**Next:** [vault config](/vault-dx/dx-reference/command-reference/config)