{"record":{"id":"d83b49b4f0c7883d","repo":"cube-js/cube","slug":"not-logged-in-run-cube-login-or-set-cube-api-u","errorCode":null,"errorMessage":"not logged in: run `cube login`, or set CUBE_API_URL and CUBE_API_KEY (or pass --api-url/--token)","messagePattern":"not logged in: run `cube login`, or set CUBE_API_URL and CUBE_API_KEY \\(or pass --api-url/--token\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"rust/cube-cli/src/main.rs","lineNumber":102,"sourceCode":"        match (url, token) {\n            (Some(url), Some(token)) => {\n                // Enable auto-refresh only when using the context's own access\n                // token and it has a refresh token saved alongside it.\n                let refresh = if self.token.is_none() {\n                    ctx.and_then(|(name, c)| {\n                        c.refresh_token\n                            .as_ref()\n                            .map(|rt| (rt.clone(), name.to_string()))\n                    })\n                } else {\n                    None\n                };\n                match refresh {\n                    Some((rt, name)) => client::Client::with_refresh(&url, &token, &rt, Some(name)),\n                    None => client::Client::new(&url, &token),\n                }\n            }\n            _ => bail!(\n                \"not logged in: run `cube login`, or set CUBE_API_URL and CUBE_API_KEY \\\n                 (or pass --api-url/--token)\"\n            ),\n        }\n    }\n}\n\n#[derive(Subcommand)]\nenum Command {\n    /// Log in to Cube Cloud and save credentials\n    Login(commands::login::Args),\n    /// Remove saved credentials\n    Logout(commands::logout::Args),\n    /// Show the currently authenticated user\n    Whoami(commands::whoami::Args),\n    /// Manage saved contexts (tenants)\n    Context(commands::context::Args),\n","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/rust/cube-cli/src/main.rs#L84-L120","documentation":"`api()` needs an API URL and token, resolved from flags, env vars (CUBE_API_URL/CUBE_API_KEY), or the logged-in default context. If none are available, the CLI is effectively unauthenticated and bails telling the user to log in or provide credentials.","triggerScenarios":"Running any remote command (`cube deployments list`, `cube validate`, etc.) before ever running `cube login`, in a fresh CI container with no config file, or with CUBE_API_URL set but CUBE_API_KEY missing.","commonSituations":"New machine setup; Docker/CI images without the CLI config mounted; env vars partially set (URL without token); expired/cleared credentials.","solutions":["Run `cube login` to authenticate interactively","Set both CUBE_API_URL and CUBE_API_KEY environment variables","Pass --api-url and --token flags explicitly for one-off invocations"],"exampleFix":"// before\ncube deployments list   # no credentials anywhere\n// after\nexport CUBE_API_URL=https://my_CUBE.cloud\nexport CUBE_API_KEY=abc123\ncube deployments list","handlingStrategy":"validation","validationCode":"const haveEnv = !!process.env.CUBE_API_URL && !!process.env.CUBE_API_KEY;\nconst haveConfig = fs.existsSync(cliConfigPath);\nif (!haveEnv && !haveConfig) {\n  throw new Error(\"not logged in: run `cube login` or set CUBE_API_URL/CUBE_API_KEY\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  run(`cube ${cmd}`);\n} catch (e) {\n  if (String(e).includes(\"not logged in\")) {\n    run(\"cube login\"); run(`cube ${cmd}`);\n  } else throw e;\n}","preventionTips":["Run `cube login` as part of machine/CI setup","Set both CUBE_API_URL and CUBE_API_KEY together — never just one","Bake credentials into CI images/secrets before invoking remote commands"],"tags":["cli","authentication","not-logged-in","env-vars"],"backgroundTag":"not-authenticated","analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}