> ## Documentation Index > Fetch the complete documentation index at: https://docs.runflow.ai/llms.txt > Use this file to discover all available pages before exploring further. # Profile Management > Manage login profiles and switch between tenants and environments RunFlow CLI supports **multi-tenant profiles**. A profile stores a login session — who you are, which tenant is active, and which API you're talking to — so you can switch between accounts, clients, and environments without re-entering credentials. A profile is created automatically when you run [`rf login`](/cli/login). Browser logins store your tokens (refreshed automatically); API-key logins store the key. ## Why Use Profiles? Profiles are perfect for: * **Agencies** managing multiple client accounts * **Developers** working across dev, staging, and production * **Teams** switching between different projects * **Consultants** handling multiple customer environments ## Commands Overview | Command | Description | | --------------------------- | ------------------------------------------------------- | | `rf login --profile ` | Log in and save the session as a named profile | | `rf switch [name]` | Switch tenant (browser login) or profile (API key) | | `rf profiles` | List all saved profiles | | `rf profiles current` | Show current active profile | | `rf profiles delete ` | Delete a profile | | `rf logout [name]` | Sign out (keeps API URL and provider for easy re-login) | ## Creating Profiles There's no separate "create profile" command — a profile is created (and activated) when you log in: ```bash theme={null} # Browser login — profile is named after the tenant you pick rf login # ✓ Login successful! # Profile: acme-corporation # Browser login with a custom profile name rf login --profile staging --api https://api.staging.yourcompany.com ``` ### Non-Interactive Profile Creation (API Key) For CI/CD and scripts, create profiles with API keys directly: ```bash theme={null} rf login --api-key sk-xxx... --profile production rf login --api-key sk-yyy... --profile development ``` ## Switching: Tenants vs. Profiles `rf switch` behaves according to how the active profile was created: * **Browser (OIDC) login** — `rf switch` moves between the **tenants of the active account**. No new login needed. * **API-key login** — `rf switch ` moves between your **saved local profiles**. To activate a different *environment* (another profile with its own API URL), log into it again — `rf login --profile ` both creates and activates that profile. See [Self-Hosted & Multiple Environments](/cli/self-hosted). ### Interactive Switch ```bash theme={null} # Searchable list (tenants for browser login, profiles for API key) rf switch # → Select active tenant: # • ACME Corporation (primary) # • Tech Startup ``` ### Direct Switch ```bash theme={null} rf switch acme-corp # ✓ Switched to tenant: ACME Corporation # Verify what's active rf profiles current # Current profile: acme-corporation (tenant: tenant_123) ``` ## Listing Profiles ```bash theme={null} # List all saved profiles rf profiles # Output: # Available profiles: # • acme-corporation (current) # • staging # • production ``` ### Show Current Profile ```bash theme={null} rf profiles current # Output: # Current profile: acme-corporation # Tenant ID: tenant_abc123 # Tenant Name: ACME Corporation # API URL: https://api.runflow.ai ``` ## Deleting Profiles ```bash theme={null} # Delete a profile (with confirmation) rf profiles delete acme-corp # ? Are you sure you want to delete profile 'acme-corp'? (y/N) # Delete without confirmation rf profiles delete acme-corp --yes # ✓ Profile 'acme-corp' deleted ``` You cannot delete the currently active profile. Switch to another profile first. To just sign out of a profile while keeping its API URL and provider, use `rf logout ` instead of deleting it — signing back in becomes a single `rf login`. ## Multi-Tenant Workflow Example ### Agency Managing Multiple Clients If your RunFlow account has access to each client's tenant, one login is enough: ```bash theme={null} rf login # → pick any tenant to start # Work with Client ACME rf switch client-acme rf agents list rf create --name acme-support-bot --template rag-agent --yes # Switch to a different client rf switch client-techco rf agents list rf kb create techco-docs ``` ### Developer: Dev, Staging, Production Separate environments (different API URLs) live in separate profiles: ```bash theme={null} # Log into each environment once rf login --profile dev --api https://api.dev.yourcompany.com rf login --profile staging --api https://api.staging.yourcompany.com rf login --profile prod --api https://api.yourcompany.com # Develop on dev (re-login activates the profile) rf login --profile dev rf create --name test-agent --template starter --yes cd test-agent/ rf test # Deploy to production rf login --profile prod rf agents deploy ``` For CI pipelines, use API-key profiles instead: ```bash theme={null} rf login --profile ci --api-key sk-ci... rf agents deploy ``` ## Configuration File Profiles are stored in `~/.runflowrc` (YAML): ```yaml theme={null} currentProfile: acme-corporation profiles: # Browser (OIDC) login acme-corporation: token: eyJhbGciOi... refreshToken: v1.MRr... tokenExpiresAt: 2026-08-01T12:00:00.000Z email: jane@acme.com tenantId: tenant_abc123 tenantName: ACME Corporation api: https://api.runflow.ai/api/v1/runtime # API key login (CI) ci: apiKey: sk-xxx... tenantId: tenant_abc123 api: https://api.runflow.ai/api/v1/runtime ``` The config file is automatically managed by the CLI. You typically don't need to edit it manually. ## Profile Aliases You can use profile names in any command that requires authentication: ```bash theme={null} # Override profile for single command rf agents list --profile production # Create agent using specific profile rf create --name test --template starter --profile development ``` ## Best Practices ### 1. Use Descriptive Names The default name (the tenant name) is usually fine. When naming manually: ```bash theme={null} # ✅ Good - clear and descriptive rf login --profile client-acme-production rf login --profile internal-dev rf login --profile staging-us-west # ❌ Avoid - unclear names rf login --profile profile1 rf login --profile test rf login --profile x ``` ### 2. Separate Environments ```bash theme={null} # Create separate profiles for each environment rf login --profile mycompany-dev --api https://api.dev.mycompany.com rf login --profile mycompany-staging --api https://api.staging.mycompany.com rf login --profile mycompany-prod --api https://api.mycompany.com ``` ### 3. Client Naming Convention For agencies managing multiple clients across environments: ```bash theme={null} rf login --profile clientname-environment rf login --profile acme-prod rf login --profile acme-dev rf login --profile techco-prod ``` ## Security Considerations Tokens and API keys are stored in plain text in `~/.runflowrc`. Ensure this file has proper permissions: ```bash theme={null} chmod 600 ~/.runflowrc ``` ### Best Practices: * Don't share your `~/.runflowrc` file * Prefer browser login for humans; reserve API keys for automation * Use environment-specific API keys * Rotate keys regularly * Delete unused profiles * Never commit `.runflowrc` to git ## Troubleshooting ### Profile Not Found ```bash theme={null} rf switch nonexistent # Error: Profile 'nonexistent' not found ``` **Solution:** List available profiles with `rf profiles` and use an existing one. Remember: with a browser login, `rf switch` expects a **tenant** name, not a profile name. ### Cannot Delete Current Profile ```bash theme={null} rf profiles delete acme-corp # Error: Cannot delete the current profile ``` **Solution:** Switch to another profile first: ```bash theme={null} rf login --profile other-profile rf profiles delete acme-corp ``` ### Expired Session If a browser-login session can no longer refresh (long inactivity, revoked access), just log in again — the profile keeps its API URL and provider: ```bash theme={null} rf login --profile staging ``` ### Lost API Key If you lose access to a profile's API key: ```bash theme={null} # Delete the old profile rf profiles delete old-profile --yes # Create new profile with new API key rf login --profile new-profile --api-key sk-new... ``` ## Next Steps Learn more about authentication Multiple environments and custom APIs Create agents with your profile Manage agents across profiles