# Flox Catalog Login Requirement Starts October 20: What You Need to Know > Starting October 20, 2026, installing, upgrading, or resolving packages from the Flox Catalog requires a free FloxHub account. Here is what changes, what stays public, and how to get your machine, CI pipelines, and AI agent sandboxes ready. Source: https://flox.dev/blog/flox-catalog-login-requirement-what-you-need-to-know/ Author: Steve Swoyer Published: 2026-10-19 ## Summary Starting **Tuesday, October 20, 2026**, Flox CLI commands that install, upgrade, or resolve packages from the Flox Catalog require a **free FloxHub account**. Searching and inspecting packages stays public, and you can still activate an existing environment that has a valid lockfile without logging in. Run **`flox auth login`** on your machine, and in CI either commit your lockfile or authenticate with a service account token. Key takeaways: - The requirement takes effect October 20, 2026, ships alongside Flox v1.19.0, and applies to older Flox CLI versions, too. - Commands that resolve packages, such as **`flox install`**, **`flox upgrade`**, and **`flox run`**, require authentication. - **`flox search`**, **`flox show`**, and **`flox pull`** for public packages and environments remain public. - An environment with a valid, committed lockfile activates without a login, in CI or anywhere else. - FloxHub accounts are free, and the free tier keeps all its existing capabilities. In August, [we announced](https://flox.dev/blog/making-flox-better-for-people-and-machines/) that certain Flox CLI operations would soon require authentication. The backstory is that as agents generate more Catalog traffic, authentication will help us identify and curb abusive automation, keeping the service responsive for everyone. That change takes effect **Tuesday, October 20, 2026**. The login requirement coincides with the release of Flox v1.19.0, but applies to older Flox CLI versions, too. Starting October 20, accessing the Flox Catalog to install packages, upgrade dependencies, or resolve new package requirements will require a **free FloxHub account**. Searching and inspecting packages will remain public. Because resolving dependencies takes more work, that's where we're requiring a login. ## What Changes… and What Doesn't Commands that resolve packages, including **`flox install`**, **`flox upgrade`**, **`flox run`**, and **`flox include upgrade`**, will require authentication. So will commands like **`flox init`**, **`flox edit`**, and **`flox activate`** when they need to resolve packages—i.e., when a [valid lockfile](https://flox.dev/docs/concepts/environments#manifest-lock) doesn’t already exist. **You can still activate an existing Flox environment without logging in, provided it has a valid lockfile.** This means CI pipelines can run without FloxHub credentials, while offline sandboxes can run without Catalog access as long as the required packages are available locally. We'll cover both cases below. Other operations remain public, including **`flox search`**, **`flox show`**, and **`flox pull`** for public packages and environments. ## Getting Ready **On your machine:** Run **`flox auth login`** and authenticate using GitHub, Google, or GitLab. If you're already logged in, there's nothing to do. **In CI:** You’ve got two options: - **Use a committed lockfile.** Commit your environment's **`manifest.lock`** alongside its manifest. Pipelines that activate an existing, correctly locked environment don't need to authenticate with the Flox Catalog. - **Authenticate your pipeline.** If your jobs install, upgrade, or resolve packages, provide a [service account token (SAT)](https://flox.dev/blog/flox-account-tokens-for-people-and-machines/) using the **`FLOX_FLOXHUB_TOKEN`** environment variable. Store credentials in your CI platform's secrets manager. **Note**: Token authentication requires Flox v1.14.0 or newer. **In AI agent environments and offline sandboxes:** The same rules apply, with one important distinction. A lockfile eliminates the need to resolve dependencies, but it doesn't eliminate the need to obtain packages. For sandboxes without internet access, prepare the locked environment and make its package dependencies available locally before launching the sandbox. Authentication tokens cannot substitute for network connectivity. **Using an older CLI?** Flox CLI versions 1.3.5 through 1.13.x support interactive login but not PATs or SATs. Versions older than v1.3.5 must be upgraded to continue resolving packages. ## Why We're Making This Change As more developers, CI systems, and AI agents depend on FloxHub, authentication helps us understand how these services are used, protect them from abusive automation, and prioritize improvements to reliability and performance. **This isn't a paywall.** FloxHub accounts are 100% free, and the free tier retains all its existing capabilities. For complete instructions and FAQs, read [the documentation](https://flox.dev/docs/concepts/authentication). Questions? Join us on [community Slack](https://go.flox.dev/slack) or [Discourse](https://discourse.flox.dev), or email support@flox.dev. --- ## Frequently Asked Questions ### Why is Flox requiring a login? As more developers, CI systems, and especially AI agents use Flox, they generate more traffic to the Flox Catalog. Authentication helps Flox identify and curb abusive automation, keeping the service responsive for everyone, and helps it understand how the service is used so it can prioritize improvements to reliability and performance. The login applies to resolving dependencies because resolving takes more work than searching for or inspecting packages. ([Why We're Making This Change](https://flox.dev/blog/flox-catalog-login-requirement-what-you-need-to-know/#why-were-making-this-change)) ### Do I need a FloxHub account to use Flox? In practice, yes. Starting October 20, 2026, installing packages, upgrading dependencies, or resolving new package requirements from the Flox Catalog requires a free FloxHub account, and that covers most of what you do when you create or change an environment. The exceptions are searching for and inspecting packages, pulling public packages and environments, and activating an existing environment that already has a valid lockfile. ([What Changes… and What Doesn't](https://flox.dev/blog/flox-catalog-login-requirement-what-you-need-to-know/#what-changes-and-what-doesnt)) ### Which Flox commands require me to log in? Commands that resolve packages, including **`flox install`**, **`flox upgrade`**, **`flox run`**, and **`flox include upgrade`**. Commands like **`flox init`**, **`flox edit`**, and **`flox activate`** also require authentication when they need to resolve packages, meaning when a [valid lockfile](https://flox.dev/docs/concepts/environments#manifest-lock) doesn’t already exist. **`flox search`**, **`flox show`**, and **`flox pull`** for public packages and environments do not. ([What Changes… and What Doesn't](https://flox.dev/blog/flox-catalog-login-requirement-what-you-need-to-know/#what-changes-and-what-doesnt)) ### How do I log in to FloxHub from the Flox CLI? Run **`flox auth login`** and authenticate using GitHub, Google, or GitLab. If you’re already logged in, there’s nothing to do. ([Getting Ready](https://flox.dev/blog/flox-catalog-login-requirement-what-you-need-to-know/#getting-ready)) ### How do I keep my CI pipelines working? You have two options. Commit your environment’s **`manifest.lock`** alongside its manifest: pipelines that activate an existing, correctly locked environment don’t need to authenticate. Or, if your jobs install, upgrade, or resolve packages, provide a [service account token](https://flox.dev/blog/flox-account-tokens-for-people-and-machines/) through the **`FLOX_FLOXHUB_TOKEN`** environment variable, stored in your CI platform’s secrets manager. Token authentication requires Flox v1.14.0 or newer. ([Getting Ready](https://flox.dev/blog/flox-catalog-login-requirement-what-you-need-to-know/#getting-ready)) ### What about AI agents and offline sandboxes? The same rules apply. A lockfile removes the need to resolve dependencies, but the sandbox still needs the packages themselves. For sandboxes without internet access, prepare the locked environment and make its package dependencies available locally before launching the sandbox. Authentication tokens can’t substitute for network connectivity. ([Getting Ready](https://flox.dev/blog/flox-catalog-login-requirement-what-you-need-to-know/#getting-ready)) ### Does the login requirement apply to older Flox CLI versions? Yes. It coincides with the Flox v1.19.0 release but applies to older versions, too. Versions 1.3.5 through 1.13.x support interactive login but not personal access tokens or service account tokens. Versions older than v1.3.5 must be upgraded to continue resolving packages. ([Getting Ready](https://flox.dev/blog/flox-catalog-login-requirement-what-you-need-to-know/#getting-ready)) ### Is Flox putting the Catalog behind a paywall? No. FloxHub accounts are 100% free, and the free tier retains all its existing capabilities. ([Why We're Making This Change](https://flox.dev/blog/flox-catalog-login-requirement-what-you-need-to-know/#why-were-making-this-change)) --- This is the Markdown version of https://flox.dev/blog/flox-catalog-login-requirement-what-you-need-to-know/. An index of everything on flox.dev is at https://flox.dev/llms.txt, and reference documentation is at https://flox.dev/docs/llms.txt.