BoundaryML/baml · error

not logged in; run `baml auth login`

Error message

not logged in; run `baml auth login`

What it means

access_token() was called when no access token is cached, i.e. the user has never completed `baml auth login` (or the credential store was cleared). The method bails immediately, directing the user to log in before any authenticated API call can be made.

Source

Thrown at baml_language/crates/baml_cli/src/auth.rs:580

    ///
    /// On Unix the file is created with mode 0600 before any bytes are
    /// written; there is never a window where the contents are readable by
    /// other users.
    pub fn write(&self) -> Result<()> {
        let path = creds_path()?;
        write_owner_only(&path, &serde_json::to_string_pretty(self)?)
    }

    /// Returns a valid access token, refreshing via the OAuth refresh-token
    /// grant when near expiry. Callers persist afterwards if they want the
    /// refreshed state kept.
    ///
    /// Errors:
    /// - When not logged in, or the session is expired and cannot be
    ///   refreshed.
    pub fn access_token(&mut self) -> Result<&str> {
        if self.access_token.is_none() {
            anyhow::bail!("not logged in; run `baml auth login`");
        }
        let expired = match self.expires_at {
            Some(at) => at <= now_unix() + 30,
            // Unknown expiry: refresh when we can, rather than trusting a
            // token we can't validate.
            None => self.refresh_token.is_some(),
        };
        if expired {
            let refresh = self
                .refresh_token
                .as_deref()
                .context("session expired; run `baml auth login` again")?;
            let tokens: TokenResponse = post_form(
                &format!("{}/user_management/authenticate", api_domain()),
                &[
                    ("grant_type", "refresh_token"),
                    ("client_id", &client_id()?),
                    ("refresh_token", refresh),

View on GitHub (pinned to bd85ce9dee)

Solutions

1. Run `baml auth login` to establish a session.
2. In CI, perform a non-interactive login or provide a token via the supported env/config mechanism before invoking authenticated commands.
3. Verify you are running as the same user/HOME that previously logged in.
4. If credentials keep vanishing, check that the config directory is writable and persisted.

Example fix

// before
let token = session.access_token()?;
// after
if !session.is_logged_in() {
    anyhow::bail!("not logged in; run `baml auth login`");
}
let token = session.access_token()?;

// check session before authenticated calls
let logged_in = std::path::Path::new(&session_path).exists();
if !logged_in { eprintln!("run `baml auth login" first"); std::process::exit(1); }

match session.access_token() {
    Ok(tok) => tok,
    Err(e) if e.to_string().contains("not logged in") => {
        run_login_interactively()?;
        session.access_token()?
    }
    Err(e) => return Err(e),
}

When it happens

Trigger: Calling AuthSession::access_token() with self.access_token == None — fresh install, logged-out state, or credentials deleted/never persisted.

Common situations: CI containers without a prior login step; running `baml` authenticated subcommands before ever running `baml auth login`; wiping the home/config directory; a different user account (HOME) than the one that logged in.

Related errors

• No credentials found
• Timed out after {} minutes waiting for the login to be confi
• Login was denied in the browser.
• the confirmation code expired before it was used; run `baml
• Auth server returned {status}: {value}

AI-assisted analysis of BoundaryML/baml@bd85ce9dee (2026-09-12). Data as JSON: /api/errors/afa59c8d5c0b9dab. Report an issue: GitHub.