🔐 Authentication

Every command needs an authenticated pCloud session. There are two ways to get one, and they are not equivalent — pick deliberately.

Session login is the default because it needs no setup and reaches the whole API. OAuth exists for when you would rather the CLI never handled your password.

🔑 Log in

pcloud login

You are asked for your email and password, and for a two-factor code if your account uses one. The password is sent to pCloud over HTTPS and is never written to disk — only the returned token is stored, at ~/.config/pcloud/tokens.json (mode 0600).

Confirm it worked:

pcloud whoami

This prints the account email, plan, and quota usage.

🌐 Log in through the browser instead

OAuth 2.0 keeps your password out of the CLI entirely, at the cost of a one-time setup and a narrower API surface.

First create a pCloud OAuth application from the pCloud OAuth 2.0 documentation and expose its credentials:

export PCLOUD_CLIENT_ID=your_client_id
export PCLOUD_CLIENT_SECRET=your_client_secret

Then:

pcloud login --oauth

This opens your browser to the pCloud authorisation page. After you approve access, pCloud redirects back to a local callback server and the token is saved to the same place.

OAuth cannot reach everything. pCloud's access tokens do not grant access to trash_list / trash_restore, and the same applies to revisions, zip and downloads. This is a limitation of the pCloud API, not of this CLI — there is no workaround. If you need those commands, use session login.

If both are stored, the session token wins: it is the strictly more capable tier.

🚪 Log out

pcloud logout

This revokes the session token with pCloud before removing the local file, so the token is dead on their side too — deleting the file alone would leave it live until it expired.

🩺 Check what your credential can reach

pcloud doctor

Probes every command against your current credential and reports which are reachable, which need a session token, and which call endpoints pCloud does not expose. It also reports local sync-daemon health — see Local sync inspection.

🤖 Bypassing the credential store

For CI or scripted contexts, set a token directly in the environment. When present, no stored credentials are read or written and login / logout are unnecessary:

export PCLOUD_ACCESS_TOKEN=your_access_token   # OAuth tier
export PCLOUD_AUTH=your_session_token          # session tier
pcloud ls /

PCLOUD_AUTH takes precedence, matching the stored-credential rule above.

🌍 Choosing a region

The CLI targets the EU API (eapi.pcloud.com) by default. If your account lives on the US infrastructure, set:

export PCLOUD_REGION=us