/login | Pensar Apex

Overview

The /login command connects your Apex CLI to Pensar Console for managed inference. Once connected, Apex uses Pensar-hosted AI models — no API key configuration required. Inference costs are tracked and deducted from your workspace’s credit balance.

The /auth command still works as an alias for backward compatibility, but /login is now the primary command name.

Usage

Inside the TUI:

$ /login

From the command line (headless):

$ pensar login           # Start the login flow
$ pensar login status    # Show current connection status
$ pensar login logout    # Disconnect from Pensar Console

The legacy pensar auth command still works for backward compatibility.

pensar login status displays your auth type (WorkOS or API key) and current workspace. When using API key auth, the command resolves your workspace from the server if it isn’t already stored locally.

How It Works

Both the TUI /login command and the CLI pensar login command use a device authorization flow — similar to how you link a streaming device to your account. Apex displays a code, you verify it in your browser, and the CLI is automatically authenticated.

Start Auth Flow

Run /login in Apex and press Enter to begin. Apex requests a device code from the Pensar authentication service.

Verify in Browser

A browser window opens automatically to the verification URL. If it doesn’t open, copy the URL displayed in the terminal and open it manually. Enter the user code shown in Apex to confirm the connection.

Select Workspace

If your account belongs to multiple workspaces, Apex presents a list showing each workspace name and current credit balance. Use the arrow keys to select a workspace and press Enter.

Billing Check

Apex verifies that the selected workspace has billing configured and sufficient credits. If billing isn’t set up or the balance is low, you’ll see a prompt with a link to the Console billing page.

Connected

On success, Apex displays your connected workspace and credit balance. You can now use Pensar-hosted models for pentesting without configuring any API keys.

Pensar Console

Pensar Console is the web platform where you manage workspaces, projects, billing, and more. When you authenticate Apex with /login, you’re linking it to a Console workspace.

If you don’t have an account yet, the verification URL will guide you through sign-up and workspace creation.

What You Can Do in Console

Manage Billing

Purchase credits, configure auto-reload, add payment methods, and view invoices from Settings > Billing.

Monitor Usage

Track Apex inference spend per user and per API key from Settings > Usage.

Manage Workspaces

Create workspaces, invite team members, and control access roles.

Run Pentests

Launch whitebox and blackbox pentests from the Console UI with full reporting.

For full billing documentation, see the Console Billing & Usage guide.

Billing

Apex inference through the Pensar gateway uses a pre-paid credits model. Credits are purchased in your Console workspace and deducted per inference request.

Key Billing Concepts

Concept	Description
Credits	Pre-paid balance (in USD) shared across your workspace
Category	Apex inference is billed under the “Apex Inference” category, separate from CI pentest usage
Per-identity tracking	Each request is attributed to the authenticated user, visible in Console’s Usage page
Pre-flight checks	Requests are rejected with a `402` error if credits are insufficient
Auto-reload	Optional automatic top-up when balance drops below a threshold

Setting Up Billing

If Apex reports that billing isn’t configured or your balance is low during /login:

Open Billing Page

Press the key shown in Apex to open the billing page in your browser, or navigate to Settings > Billing in Console manually.

Add Payment Method

Add a credit or debit card via the inline form on the Billing page.

Purchase Credits

Buy credits via a one-time purchase ( $10 /$ 30 / $50 /$ 100 or custom) or set up a monthly subscription.

Enable Apex Inference

On the Settings > Usage page, ensure the “Apex Inference” toggle is enabled. This is turned on automatically when you add your first payment method.

For detailed billing documentation including auto-reload, invoices, and usage tracking, see Console Billing & Usage.

Disconnecting

When connected, press [D] on the /login screen to disconnect. This clears the stored authentication tokens from your local Apex configuration. You can reconnect at any time by running /login again.

Configuration

Authentication state is stored in your local Apex configuration at ~/.pensar/. The following values are managed by the /login flow:

Config Key	Description
`accessToken`	Short-lived access token for API requests
`refreshToken`	Long-lived token used to refresh the access token
`workspaceId`	Selected workspace ID
`workspaceSlug`	Selected workspace slug
`signingKey`	HMAC signing key for authenticated gateway inference requests
`gatewayUrl`	Inference gateway URL (defaults to gateway.pensar.dev)

Tokens are automatically refreshed when they expire. You do not need to re-run /login unless you want to switch workspaces or have explicitly disconnected.

Expired Session Notifications

If your Pensar Console session has truly expired (access token expired and no valid refresh token), Apex will show a toast notification on startup prompting you to run /login to refresh. If you have a valid refresh token, your session will be silently restored on the next API call without any notification.

Troubleshooting

Browser doesn't open automatically

Copy the verification URL displayed in the terminal and open it in your browser manually. The URL and user code remain valid for several minutes.

'Billing not ready' after connecting

Navigate to Settings > Billing in Console and add a payment method. Then purchase credits and ensure the Apex Inference category is enabled on the Usage page. See Console Billing & Usage for step-by-step instructions.

'Insufficient credits' errors during pentesting

Your workspace balance is too low. Purchase additional credits from Settings > Billing in Console, or enable auto-reload to prevent future interruptions. See Console Billing & Usage.

Want to switch workspaces

Press [D] to disconnect, then run /login again. You’ll be prompted to select a workspace during the new auth flow.

Auth flow times out

Device codes expire after a few minutes. Run /login again to restart the flow with a fresh code.

/credits

Check your credit balance or open the purchase page.

/providers

Configure API keys for direct provider access (alternative to managed inference).

/models

Select which AI model to use for testing.

/pentest

Launch a penetration test after connecting.