Command	Purpose
`login-wallet --private-key-env <name>`	Sign in with a locally available private key from an environment variable
`login-wallet --private-key-file <path>`	Sign in with a locally available private key from a file
`login-wallet --private-key <hex> --allow-unsafe-private-key-argv`	Sign in with an inline private key when argv exposure is explicitly accepted
`login-wallet --prepare`	Fetch a challenge for external signing
`login-wallet --nonce <nonce> --signature <sig>`	Verify an externally signed challenge and save the session
`status`	Show saved Portal session user and target URL status without exposing the token
`logout`	Remove the local saved Portal session file

Rules

Do not assume the CLI must control the wallet private key.
If the wallet can sign the challenge message, use the prepare + verify flow.
External signers such as Privy are valid as long as they return a standard wallet signature for the challenge.
If neither a local private key nor --signature is available, return the challenge payload and stop.
Before local auto-signing, validate that the returned challenge matches the requested wallet, chain, and expected AltLLM login challenge structure.
For non-default, non-loopback API hosts, prefer --prepare and external signing instead of local auto-signing.
Current backend support is still limited to EVM addresses and Ethereum-style signatures.
Save the resulting session to ~/.altllm/portal-cli-session.json unless overridden.
Use status or its whoami alias to confirm the saved user and target URL before running live commands.
logout only removes the local session file. It does not revoke API keys.

Reference

See references/cli-reference.md for commands, payloads, and troubleshooting notes.