Flox Catalog Login Requirement Starts October 20: What You Need to Know

In August, we announced that certain Flox CLI operations would soon require authentication. The backstory is that as agents generate more Catalog traffic, authentication will help us identify and curb abusive automation, keeping the service responsive for everyone.

That change takes effect Tuesday, October 20, 2026.

The login requirement coincides with the release of Flox v1.19.0, but applies to older Flox CLI versions, too. Starting October 20, accessing the Flox Catalog to install packages, upgrade dependencies, or resolve new package requirements will require a free FloxHub account. Searching and inspecting packages will remain public. Because resolving dependencies takes more work, that's where we're requiring a login.

What Changes… and What Doesn't

Commands that resolve packages, including flox install, flox upgrade, flox run, and flox include upgrade, will require authentication. So will commands like flox init, flox edit, and flox activate when they need to resolve packages—i.e., when a valid lockfile doesn’t already exist.

You can still activate an existing Flox environment without logging in, provided it has a valid lockfile. This means CI pipelines can run without FloxHub credentials, while offline sandboxes can run without Catalog access as long as the required packages are available locally. We'll cover both cases below.

Other operations remain public, including flox search, flox show, and flox pull for public packages and environments.

Getting Ready

On your machine: Run flox auth login and authenticate using GitHub, Google, or GitLab. If you're already logged in, there's nothing to do.

In CI: You’ve got two options:

• Use a committed lockfile. Commit your environment's manifest.lock alongside its manifest. Pipelines that activate an existing, correctly locked environment don't need to authenticate with the Flox Catalog.
• Authenticate your pipeline. If your jobs install, upgrade, or resolve packages, provide a service account token (SAT) using the FLOX_FLOXHUB_TOKEN environment variable. Store credentials in your CI platform's secrets manager. Note: Token authentication requires Flox v1.14.0 or newer.

In AI agent environments and offline sandboxes: The same rules apply, with one important distinction. A lockfile eliminates the need to resolve dependencies, but it doesn't eliminate the need to obtain packages. For sandboxes without internet access, prepare the locked environment and make its package dependencies available locally before launching the sandbox. Authentication tokens cannot substitute for network connectivity.

Using an older CLI? Flox CLI versions 1.3.5 through 1.13.x support interactive login but not PATs or SATs. Versions older than v1.3.5 must be upgraded to continue resolving packages.

Why We're Making This Change

As more developers, CI systems, and AI agents depend on FloxHub, authentication helps us understand how these services are used, protect them from abusive automation, and prioritize improvements to reliability and performance.

This isn't a paywall. FloxHub accounts are 100% free, and the free tier retains all its existing capabilities.

For complete instructions and FAQs, read the documentation. Questions? Join us on community Slack or Discourse, or email support@flox.dev.

---

Frequently Asked Questions