Skip to main content
The CLI uses different credentials for each backend. Local needs nothing from you; remote needs an API key.

​
Local backend (desktop bridge)

When the OpenWhispr desktop app is running, it exposes a loopback HTTP bridge on 127.0.0.1. The app writes a one-time bearer token to ~/.openwhispr/cli-bridge.json (mode 0600) at startup; the CLI reads it automatically. You don’t need to run auth login for local mode. If the desktop app is closed or hasn’t started the bridge yet, the CLI treats local as unavailable.

​
Remote backend (cloud API)

Generate a key and store it locally:
1

Create an API key

Open the desktop app, go to Integrations > API Keys, and create a key with the scopes you need (notes:read, notes:write, transcriptions:delete, etc.).Keys look like owk_live_abc123... and are shown once.
2

Store the key

The CLI prompts for the key and saves it to ~/.openwhispr/cli-config.json with 0600 permissions.
3

Confirm it works

Reports whether a key is configured — a local check only, no network call. To confirm the cloud API actually accepts it, run openwhispr doctor.

​
Logout

Clears the key from ~/.openwhispr/cli-config.json. The desktop bridge token is not affected.

​
Scopes

API-key scopes are enforced server-side. If a command fails with exit code 3 and a “scope” error, the key is missing the required scope — regenerate it from the desktop app with the right boxes ticked. One exception, and it bites: transcriptions:delete has no checkbox in the desktop app, so openwhispr transcriptions delete fails with a scope error on any key created there. Create that key through the API instead, naming the scope explicitly.
Use a personal key (owk_live_). The CLI works against your own notes and doesn’t address team-space content, so a workspace key (ow_wks_live_) won’t work here — see Workspace API keys.