> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.pensar.dev/apex/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pensar.dev/apex/_mcp/server. # /login > Connect Apex to Pensar Console for managed inference and billing ## Overview The `/login` command connects your Apex CLI to [Pensar Console](https://console.pensar.dev) for **managed inference**. Once connected, Apex uses Pensar-hosted AI models — no API key configuration required. Inference costs are tracked and deducted from your workspace's credit balance. > **Note** > > The `/auth` command still works as an alias for backward compatibility, but `/login` is now the primary command name. ## Usage Inside the TUI: ```bash /login ``` From the command line (headless): ```bash pensar login # Start the login flow pensar login status # Show current connection status pensar login logout # Disconnect from Pensar Console ``` The legacy `pensar auth` command still works for backward compatibility. `pensar login status` displays your auth type (WorkOS or API key) and current workspace. When using API key auth, the command resolves your workspace from the server if it isn't already stored locally. ## How It Works Both the TUI `/login` command and the CLI `pensar login` command use a **device authorization flow** — similar to how you link a streaming device to your account. Apex displays a code, you verify it in your browser, and the CLI is automatically authenticated. #### Start Auth Flow Run `/login` in Apex and press Enter to begin. Apex requests a device code from the Pensar authentication service. #### Verify in Browser A browser window opens automatically to the verification URL. If it doesn't open, copy the URL displayed in the terminal and open it manually. Enter the **user code** shown in Apex to confirm the connection. #### Select Workspace If your account belongs to multiple workspaces, Apex presents a list showing each workspace name and current credit balance. Use the arrow keys to select a workspace and press Enter. #### Billing Check Apex verifies that the selected workspace has billing configured and sufficient credits. If billing isn't set up or the balance is low, you'll see a prompt with a link to the Console billing page. #### Connected On success, Apex displays your connected workspace and credit balance. You can now use Pensar-hosted models for pentesting without configuring any API keys. ## Pensar Console [Pensar Console](https://console.pensar.dev) is the web platform where you manage workspaces, projects, billing, and more. When you authenticate Apex with `/login`, you're linking it to a Console workspace. If you don't have an account yet, the verification URL will guide you through sign-up and workspace creation. ### What You Can Do in Console #### Manage Billing Purchase credits, configure auto-reload, add payment methods, and view invoices from **Settings > Billing**. #### Monitor Usage Track Apex inference spend per user and per API key from **Settings > Usage**. #### Manage Workspaces Create workspaces, invite team members, and control access roles. #### Run Pentests Launch whitebox and blackbox pentests from the Console UI with full reporting. For full billing documentation, see the [Console Billing & Usage](/console/features/billing) guide. ## Billing Apex inference through the Pensar gateway uses a **pre-paid credits** model. Credits are purchased in your Console workspace and deducted per inference request. ### Key Billing Concepts | Concept | Description | | ------------------------- | -------------------------------------------------------------------------------------------- | | **Credits** | Pre-paid balance (in USD) shared across your workspace | | **Category** | Apex inference is billed under the "Apex Inference" category, separate from CI pentest usage | | **Per-identity tracking** | Each request is attributed to the authenticated user, visible in Console's Usage page | | **Pre-flight checks** | Requests are rejected with a `402` error if credits are insufficient | | **Auto-reload** | Optional automatic top-up when balance drops below a threshold | ### Setting Up Billing If Apex reports that billing isn't configured or your balance is low during `/login`: #### Open Billing Page Press the key shown in Apex to open the billing page in your browser, or navigate to **Settings > Billing** in Console manually. #### Add Payment Method Add a credit or debit card via the inline form on the Billing page. #### Purchase Credits Buy credits via a one-time purchase ($10 / $30 / $50 / $100 or custom) or set up a monthly subscription. #### Enable Apex Inference On the **Settings > Usage** page, ensure the "Apex Inference" toggle is enabled. This is turned on automatically when you add your first payment method. For detailed billing documentation including auto-reload, invoices, and usage tracking, see [Console Billing & Usage](/console/features/billing). ## Disconnecting When connected, press `[D]` on the `/login` screen to disconnect. This clears the stored authentication tokens from your local Apex configuration. You can reconnect at any time by running `/login` again. ## Configuration Authentication state is stored in your local Apex configuration at `~/.pensar/`. The following values are managed by the `/login` flow: | Config Key | Description | | --------------- | ------------------------------------------------------------- | | `accessToken` | Short-lived access token for API requests | | `refreshToken` | Long-lived token used to refresh the access token | | `workspaceId` | Selected workspace ID | | `workspaceSlug` | Selected workspace slug | | `signingKey` | HMAC signing key for authenticated gateway inference requests | | `gatewayUrl` | Inference gateway URL (defaults to gateway.pensar.dev) | Tokens are automatically refreshed when they expire. You do not need to re-run `/login` unless you want to switch workspaces or have explicitly disconnected. ## Expired Session Notifications If your Pensar Console session has truly expired (access token expired and no valid refresh token), Apex will show a toast notification on startup prompting you to run `/login` to refresh. If you have a valid refresh token, your session will be silently restored on the next API call without any notification. ## Troubleshooting #### Browser doesn't open automatically Copy the verification URL displayed in the terminal and open it in your browser manually. The URL and user code remain valid for several minutes. #### 'Billing not ready' after connecting Navigate to **Settings > Billing** in Console and add a payment method. Then purchase credits and ensure the Apex Inference category is enabled on the Usage page. See [Console Billing & Usage](/console/features/billing) for step-by-step instructions. #### 'Insufficient credits' errors during pentesting Your workspace balance is too low. Purchase additional credits from **Settings > Billing** in Console, or enable auto-reload to prevent future interruptions. See [Console Billing & Usage](/console/features/billing#auto-reload). #### Want to switch workspaces Press `[D]` to disconnect, then run `/login` again. You'll be prompted to select a workspace during the new auth flow. #### Auth flow times out Device codes expire after a few minutes. Run `/login` again to restart the flow with a fresh code. ## Related Commands #### [/credits](/apex/tui-slash-commands/credits) Check your credit balance or open the purchase page. #### [/providers](/apex/tui-slash-commands/providers) Configure API keys for direct provider access (alternative to managed inference). #### [/models](/apex/tui-slash-commands/models) Select which AI model to use for testing. #### [/pentest](/apex/tui-slash-commands/pentest) Launch a penetration test after connecting.