Authentication
Log in to the HelixMind web platform, manage API keys, and understand feature gating by subscription tier.
Authentication
HelixMind uses a browser-based login flow to connect your CLI to your web platform account. After a one-time login, credentials are cached locally and the CLI works offline.
Login
# Browser-based login (recommended)
helixmind login
# Direct API key login
helixmind login --api-key hm_your_key_here
# Custom platform URL
helixmind login --url https://your-instance.example.com
# Re-authenticate (even if already logged in)
helixmind login --force
How the Browser Flow Works
- The CLI starts a temporary local server on
127.0.0.1 - Your default browser opens the HelixMind authorization page
- You log in (or authorize immediately if already signed in)
- The webapp redirects back to the CLI with an API key
- The CLI stores the key locally at
~/.helixmind/config.json
The flow uses a cryptographic state parameter for CSRF protection. The local callback server accepts exactly one response and times out after 120 seconds.
If the browser cannot be opened automatically, the CLI prints the URL for you to open manually.
Logout
# Logout and revoke the API key on the server
helixmind logout
# Logout locally only (keep server key valid)
helixmind logout --no-revoke
Check Status
helixmind whoami
Shows your email, subscription plan, and masked API key. Works offline with cached data.
Slash Commands
During an interactive chat session, you can also use:
| Command | Description |
|---|---|
/login | Start login flow |
/logout | Log out and revoke key |
/whoami | Show account info |
Auth Guard. Login vs Open Source
When you first start HelixMind, you see a choice screen with two options:
- Login (recommended). free account, unlocks Jarvis, Validation Matrix, Security Monitor, and more
- Open Source: no account needed, full CLI agent with 22 tools and spiral memory
HelixMind never forces login. You can always continue in Open Source mode. If login fails, the CLI automatically falls back to Open Source mode.
Run helixmind login anytime to upgrade from Open Source to the full experience.
Feature Gating
When using Open Source mode (no login), the following commands are locked:
| Locked Command | Feature | Unlock |
|---|---|---|
/jarvis | Jarvis | helixmind login (Free+) |
/auto | Autonomous Mode | helixmind login (Free+) |
/security | Security Audit | helixmind login (Free+) |
/monitor | Security Monitor | helixmind login (Free+) |
/validation | Validation Matrix | helixmind login (Free+) |
These commands show a lock indicator and a login hint when accessed without an account. They also don't appear in autocomplete suggestions.
Subscription Tiers
| Feature | Open Source | Free+ (Login) | Pro | Team | Enterprise |
|---|---|---|---|---|---|
| AI Coding Agent | Yes | Yes | Yes | Yes | Yes |
| 22 Agent Tools | Yes | Yes | Yes | Yes | Yes |
| Spiral Memory | 1 local brain | 3 brains | 15 brains | Unlimited | Unlimited |
| All Providers | Yes | Yes | Yes | Yes | Yes |
| Web Knowledge Enricher | Yes | Yes | Yes | Yes | Yes |
| Bug Journal + Browser | Yes | Yes | Yes | Yes | Yes |
| Brain Visualization | Yes | Yes | Yes | Yes | Yes |
| Jarvis | . | 1 instance | 3 instances | Unlimited | Unlimited |
| Validation Matrix | . | Basic | Full | Full | Full |
| Security Monitor | . | . | Yes | Yes | Yes |
| Autonomous Mode | . | Yes | Yes | Yes | Yes |
| Brain Management | . | Yes | Yes | Yes | Yes |
| Live Brain WebSocket | . | Yes | Yes | Yes | Yes |
| Cloud Sync | . | . | Yes | Yes | Yes |
| Team Features | . | . | . | Yes | Yes |
| Self-Hosted / API | . | . | . | . | Yes |
Open Source (no account) gives you the full CLI agent. 22 tools, spiral memory, all providers, browser control, bug tracking, and sessions.
Free+ (free login) adds Jarvis, Validation Matrix, Autonomous Mode, Brain Management, and Live Brain. No credit card, no trial, free forever.
API Keys
API keys are prefixed with hm_ and stored hashed (SHA-256) on the server. Each key has scopes (cli, relay) and a device name.
Key limits by plan:
| Plan | Max API Keys |
|---|---|
| Free | 3 |
| Pro | 10 |
| Team | 25 |
| Enterprise | Unlimited |
You can manage API keys from your web dashboard at Dashboard > API Keys.
Config Keys
Authentication stores the following keys in ~/.helixmind/config.json:
| Key | Description |
|---|---|
relay.apiKey | Your HelixMind API key |
relay.url | Web platform URL |
relay.userId | Your user ID |
relay.userEmail | Your email address |
relay.plan | Your subscription plan |
relay.loginAt | Timestamp of last login |
relay.autoConnect | Auto-connect to relay on startup |