Skip to main content
SimpleFunctions has three auth flavors depending on the surface:

​
CLI login

Opens a browser. After authorization, the CLI receives a long-lived API key and writes it to ~/.config/simplefunctions/config.json.

​
Manual API key

Get one at simplefunctions.dev/dashboard/keys. Set:

​
HTTP

​
User scoping

Authenticated account and portfolio routes are scoped to the authenticated user. Do not pass userId from the client for normal reads — server-side resolution always wins.

​
Secrets

The CLI and API never return raw exchange private keys. Key metadata may include presence, id suffixes, or created/rotated timestamps, but never secret material.

​
BYOK encryption (cloud autopilot)

sf portfolio enable does:
1

Read local Kalshi PEM

From your local ~/.config/simplefunctions/config.json or environment variable.
2

Encrypt client-side

AES-256-GCM with your SimpleFunctions account-derived key. The plain PEM never leaves the local process.
3

Upload ciphertext

POST /api/portfolio/secrets. Server stores ciphertext only.
4

Decrypt during ticks only

Decryption happens inside the cloud tick runner only for the active tick, then the key is erased from process memory.

​
See also

API keys

Scopes and rotation.

Portfolio autopilot

Cloud autopilot setup with BYOK.

Security

Encryption and audit guarantees.