Skip to main content
A profile stores an API URL and a default organization. Browser login caches a user token for that profile. One user token can access your memberships across organizations; you do not need a separate profile for every organization.

​
Create a profile

Provide an API URL when you create a non-default profile:
Existing profiles reuse their saved URL unless you override it. For a different Tolmo environment, sign in to a separate profile using that environment’s API URL. Cached user tokens are bound to the issuing API origin.

​
Select a profile

The resolution order is --profile, then TOLMO_PROFILE, then default. auth status reports the effective values and their sources.

​
Switch organizations

org switch saves the organization. --org overrides it for one command. TOLMO_ORG_SLUG also overrides the saved value. Your CLI session always runs in the context of one active organization. tolmo org list shows every organization your account can access. tolmo org switch <slug> sets the active organization for the current profile, or for the profile you pass with --profile.
Run tolmo auth status to confirm which organization and profile are active. This helps when you work across several profiles or organizations in the same terminal.
org list requires a user token from browser login. With an API key in TOLMO_API_TOKEN, set TOLMO_ORG_SLUG instead of using org switch.

​
Credential storage

Profile settings live in ~/.tolmo/config. Cached user tokens live under ~/.tolmo/cache/sso/. Organization API keys are supplied through TOLMO_API_TOKEN, not stored in profiles. When that variable is set, the CLI bypasses profile settings and cached credentials. See Environment variables.

​
Sign out of a profile

Logout attempts server-side revocation and clears the cached user credential. It retains the profile’s API URL and organization. Without --profile, it uses TOLMO_PROFILE or default, just like other commands.