{"record":{"id":"afa59c8d5c0b9dab","repo":"BoundaryML/baml","slug":"not-logged-in-run-baml-auth-login","errorCode":null,"errorMessage":"not logged in; run `baml auth login`","messagePattern":"not logged in; run `baml auth login`","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"baml_language/crates/baml_cli/src/auth.rs","lineNumber":580,"sourceCode":"    ///\n    /// On Unix the file is created with mode 0600 before any bytes are\n    /// written; there is never a window where the contents are readable by\n    /// other users.\n    pub fn write(&self) -> Result<()> {\n        let path = creds_path()?;\n        write_owner_only(&path, &serde_json::to_string_pretty(self)?)\n    }\n\n    /// Returns a valid access token, refreshing via the OAuth refresh-token\n    /// grant when near expiry. Callers persist afterwards if they want the\n    /// refreshed state kept.\n    ///\n    /// Errors:\n    /// - When not logged in, or the session is expired and cannot be\n    ///   refreshed.\n    pub fn access_token(&mut self) -> Result<&str> {\n        if self.access_token.is_none() {\n            anyhow::bail!(\"not logged in; run `baml auth login`\");\n        }\n        let expired = match self.expires_at {\n            Some(at) => at <= now_unix() + 30,\n            // Unknown expiry: refresh when we can, rather than trusting a\n            // token we can't validate.\n            None => self.refresh_token.is_some(),\n        };\n        if expired {\n            let refresh = self\n                .refresh_token\n                .as_deref()\n                .context(\"session expired; run `baml auth login` again\")?;\n            let tokens: TokenResponse = post_form(\n                &format!(\"{}/user_management/authenticate\", api_domain()),\n                &[\n                    (\"grant_type\", \"refresh_token\"),\n                    (\"client_id\", &client_id()?),\n                    (\"refresh_token\", refresh),","sourceCodeStart":562,"sourceCodeEnd":598,"githubUrl":"https://github.com/BoundaryML/baml/blob/bd85ce9dee1463ff04d27efd20531013a4ff46c1/baml_language/crates/baml_cli/src/auth.rs#L562-L598","documentation":"access_token() was called when no access token is cached, i.e. the user has never completed `baml auth login` (or the credential store was cleared). The method bails immediately, directing the user to log in before any authenticated API call can be made.","triggerScenarios":"Calling AuthSession::access_token() with self.access_token == None — fresh install, logged-out state, or credentials deleted/never persisted.","commonSituations":"CI containers without a prior login step; running `baml` authenticated subcommands before ever running `baml auth login`; wiping the home/config directory; a different user account (HOME) than the one that logged in.","solutions":["Run `baml auth login` to establish a session.","In CI, perform a non-interactive login or provide a token via the supported env/config mechanism before invoking authenticated commands.","Verify you are running as the same user/HOME that previously logged in.","If credentials keep vanishing, check that the config directory is writable and persisted."],"exampleFix":"// before\nlet token = session.access_token()?;\n// after\nif !session.is_logged_in() {\n    anyhow::bail!(\"not logged in; run `baml auth login`\");\n}\nlet token = session.access_token()?;","handlingStrategy":"try-catch","validationCode":"// check session before authenticated calls\nlet logged_in = std::path::Path::new(&session_path).exists();\nif !logged_in { eprintln!(\"run `baml auth login\" first\"); std::process::exit(1); }","typeGuard":null,"tryCatchPattern":"match session.access_token() {\n    Ok(tok) => tok,\n    Err(e) if e.to_string().contains(\"not logged in\") => {\n        run_login_interactively()?;\n        session.access_token()?\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Always run `baml auth login` once before authenticated commands, including in CI setup scripts.","Persist the credentials/config directory in containers or mount it as a secret.","Run commands under the same user/HOME that performed the login.","Gate authenticated workflows on a session-existence check."],"tags":["auth","login","cli","credentials"],"backgroundTag":"authentication-required","analyzedSha":"bd85ce9dee1463ff04d27efd20531013a4ff46c1","analyzedAt":"2026-09-12T03:38:25.718Z","contentChangedAt":"2026-09-12T03:38:25.718Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}