Authentication - Cargo | GTM Infrastructure for AI Agents

There is one credential. The CLI holds it, and everything reads it: the REST API, the CDK, the skills, and the MCP bridge. Sign in once and nothing else needs configuring.

npm install -g @cargo-ai/cli
cargo-ai login --email you@company.com

A new account starts with 100 free credits and needs no card. --email mails a one-time code and creates the account and a workspace on first use.

Methods

You are	Use	Browser
An agent, a sandbox, CI, any shell	`cargo-ai login --email you@company.com`	no
A person at a workstation	`cargo-ai login --oauth`	yes
CI with a token already issued	`cargo-ai login --token <token>` or `CARGO_API_TOKEN`	no

In an agent or sandbox shell with no terminal to prompt at, the first --email call sends the code and exits. Re-run it with --code.

Calling the API

curl https://api.getcargo.io/v1/storage/models/list \
  -H "Authorization: Bearer $CARGO_API_TOKEN"

See API Reference for the rest of the surface.

OAuth

Authorization-server metadata (RFC 8414): https://auth.getcargo.io/.well-known/oauth-authorization-server. Device code, authorization code with PKCE (S256), registration, and revocation. The product MCP server at https://mcp.getcargo.io challenges with OAuth. See MCP servers.

Machine-readable walkthrough

The WorkOS auth.md walkthrough — Discover, Pick a method, Register, Claim, Use, Revocation — is https://www.getcargo.ai/auth.md.

​Methods

​Calling the API

​OAuth

​Machine-readable walkthrough

Methods

Calling the API

OAuth

Machine-readable walkthrough