In August we shared that some Flox commands would soon need a free FloxHub account. Starting Tuesday, October 20, you’ll need to be logged in to install packages, upgrade them, or do anything else that resolves packages from the Flox Catalog.
Searching and inspecting packages stays public. So does activating an environment whose lockfile is up to date, including in CI.
As more developers, CI systems, and AI agents use Flox, this lets us protect the catalog from runaway automation and keep package resolution fast for everyone.
What changes
Commands that need a login: flox install, flox upgrade, flox run, and any command that has to lock an environment because its lockfile is missing or its packages changed (for example flox edit or flox activate).
Commands that stay public: flox search, flox show, flox pull for public environments, and flox activate or flox build with a current lockfile.
To get ready
- Run
flox auth login. It takes about a minute. Accounts are free, and this isn’t a paywall: the free tier keeps everything it can do today. - In CI, a pipeline that only activates an environment with a committed
manifest.lockneeds no changes. However, a CI pipeline that installs or upgrades packages needs a token: setFLOX_FLOXHUB_TOKENto a personal access token or a service account token. On GitHub Actions, pass the token toflox/install-flox-actionasfloxhub-token.
Already logged in? Then there’s nothing to do.
Older Flox versions
We timed the change to land with Flox 1.19.0, but the Flox Catalog enforces it, so it applies to every Flox version. Staying on an older release doesn’t postpone it.
| Flox version | What you need |
|---|---|
| 1.14.0 and newer | flox auth login, or a token in FLOX_FLOXHUB_TOKEN |
| 1.3.5 through 1.13 | flox auth login. Tokens need 1.14.0 |
| Before 1.3.5 | Upgrade first. These versions can’t log in to the catalog |
Details and FAQ: Authentication - Flox. Questions are welcome below.