# Authentication commands

> Connect a service, map an alias to an existing authentication by UUID, and list the aliases your Helix project uses.

The `auth` commands wire your project to authentications: stored credentials for services like Salesforce, Slack, or Google Sheets. Your code refers to each one by a short alias, so the raw credentials stay on the platform and never reach your machine or your coding agent.

Log in and select a workspace before you run any of these. Authentications belong to a workspace, so `helix login` and `helix workspace select` have to come first.

## Where authentications come from

You create authentications in Tray iPaaS today, then connect them to a Helix project with the commands below. Two types are supported:

| Type | What it holds |
|---|---|
| OAuth 2.0 | A token obtained by authorizing Helix against the service, carrying a set of scopes |
| API Token | A key or token issued by the service, carrying a set of scopes |

The scopes on an authentication decide what your app can do with it. If a call fails with a permissions error, check the scopes on the authentication before you change your code.

:::roadmap
Creating authentications from inside Helix is planned. Until it ships, create them in Tray iPaaS and connect them here.
:::

## helix auth connect

```bash
helix auth connect [service]
```

Connects a service to your project. Run it without a service name to discover what's available interactively and pick from the list. Pass a name to go straight to that service.

```bash
helix auth connect
helix auth connect salesforce
```

## helix auth add

```bash
helix auth add <alias> <uuid>
```

Maps an alias to an authentication you already have, identified by its UUID. Use this when you know exactly which authentication you want, or when you're scripting setup and can't use the interactive picker.

The alias is the name your code uses, so pick something readable and stable.

```bash
helix auth add salesforce_prod 11223344-5566-7788-99aa-bbccddeeff00
```

## helix auth list

```bash
helix auth list
```

Lists the aliases configured for this project. Use it to check an alias name before you reference it in code, or to confirm a `connect` or `add` landed.

For how to call an authenticated service from a function, see the [connected services guide](/documentation/guides/connected-services/).

---

Canonical: https://helix.tray.ai/documentation/reference/cli/auth/
Any link on this page is available as markdown by appending .md to its URL.
Full corpus: https://helix.tray.ai/documentation/llms-full.txt