​
Sign in

This opens Google sign-in in your browser, catches the redirect on a local loopback listener, and provisions your workspace, twin, and an sk-kaya-* API key automatically. You never see or paste the key — it’s plumbing, saved to the CLI config file.
If you were already using Bestmate as a guest (via the app or a shared key), signing in claims that guest workspace for your account — nothing you captured is lost.

​
Fallbacks

If the browser flow can’t complete (headless box, SSH session, locked-down browser), or you already hold a key:

​
API keys

sk-kaya-* keys are the credential this CLI, the MCP server, and your AI agents sign in with. Create one to hand to a person or an agent; revoke it any time.
keys create prints the secret exactly once. Copy it then — there is no way to retrieve it later. You cannot revoke the key this CLI is currently logged in with; log in again first.

​
Configuration

Shows the active twin, the API base URL, and where the config file lives. Change the active twin with bestmate twin switch.
Links a number (E.164 format) to your account so the Bestmate iMessage bot recognizes you when you text it, and so escalations can reach you there.

​
Troubleshooting

Your key was revoked or the config is stale. Run bestmate login again — the browser flow mints a fresh key.
The CLI prints this and falls back. Use bestmate login --paste with a key from bestmate keys create on a machine where the browser flow does work.