Fix CLI login

Use this page when a production alterac-ai command cannot authenticate. CLI authentication uses the same account and two-factor protections as the application.

Run:

alterac-ai login

Complete the email, password, and current authenticator-code prompts. Then rerun the command that stopped.

The expected result is a successful login followed by normal command output. If the command is being run in an initialized repository, keep using that repository rather than copying its local configuration elsewhere.

First run alterac-ai login again and finish the interactive sign-in. If you intentionally need to change accounts, run alterac-ai logout first, then run alterac-ai login.

The expected result is that the next command uses the newly accepted account. If the authenticator is unavailable, the CLI cannot accept a recovery code. Sign in to the application with an unused recovery code, restore access to the authenticator, then retry alterac-ai login. If no authenticator or recovery code remains, see Fix account access instead of trying to remove authentication files manually.

Check the account shown by the successful login and make sure you are using the CLI distributed for your organization. Production commands do not need a local API address. Developers testing a local build should follow their project's development instructions; that is separate from normal user recovery.

The expected result is that the command can read the projects and work available to the signed-in account. If it cannot, use the application to confirm that the account has access without attempting to infer resources you cannot open.

A protected request can return 403 Forbidden with code: "LegalAgreementRequired", requiredDocuments, and agreementUrl: "/account/legal-agreement". Logging in again does not provide agreement evidence. Open the alterac.ai app in your browser, sign in with the same account, and complete Review legal documents. Then retry the CLI command. The CLI does not provide an agreement command.

API clients can use the authenticated contract directly. Read both public documents at GET /legal/privacy-policy and GET /legal/terms-of-use, and ask the person to explicitly agree to both. Send one POST /account/legal-agreement with agreeToPrivacyPolicy and agreeToTermsOfUse set to true, privacyPolicyVersion and termsOfUseVersion from those responses, and privacyPolicyIntegrityIdentifier and termsOfUseIntegrityIdentifier from their respective integrityIdentifier fields. Use the same account's authenticated cookie or bearer session. These fields are the JSON request body itself.

Proceed only when the response confirms hasAcceptedCurrentDocuments: true for the pair you submitted. GET /account/legal-agreement checks current status. A stale pair returns 400 with a legalAgreement validation error: read both current documents and request explicit choices again. If a later protected request returns LegalAgreementRequired, repeat this process. Do not silently send affirmative claims or reuse another person's agreement.

If sign-in succeeds but repository commands fail, see Fix repository setup. See alterac.ai terminology for the identifiers shown by CLI output.