turso "not authenticated" (TURSO_API_TOKEN) in CI

By Daniel Zoghalchali·Latchkey

The Turso CLI authenticates through a browser by default. In CI there is no browser, so it reads a token from TURSO_API_TOKEN. Without the token, commands that touch your organization report that you are not logged in.

What this error means

A "turso db" command fails with "You are not logged in. Please login with turso auth login" in the workflow, though it works locally after an interactive login.

Error: You are not logged in, please login with `turso auth login`

Common causes

No API token in the environment

The CLI cannot complete the interactive login headlessly and TURSO_API_TOKEN is unset, so it has no credential.

The token is expired or for the wrong org

A stale or wrongly scoped token authenticates against nothing useful, so org-scoped commands still fail.

How to fix it

Set TURSO_API_TOKEN as a secret

1. Create a token with turso auth api-tokens create ci locally.
2. Store the value as a CI secret.
3. Expose it to every turso command in the job.

env:
  TURSO_API_TOKEN: ${{ secrets.TURSO_API_TOKEN }}
run: turso db list

Install the CLI then run with the token

Install the pinned CLI and run org-scoped commands with the token in the environment.

curl -sSfL https://get.tur.so/install.sh | bash
export PATH="$HOME/.turso:$PATH"
turso db list

How to prevent it

• Use an API token for CI, never the interactive login.
• Set TURSO_API_TOKEN at the job level so all steps inherit it.
• Rotate the token and update the secret when it expires.

Frequently asked questions

Related guides

References

• GitHub Actions documentation