auth

Sign this machine in to a panel, see who it acts as, and review or revoke the sessions and tokens that have access.

The auth group signs this machine in and out, and manages the browser sessions and machine tokens that sign-in creates on your account. Sign in once per machine with login, or with login --token in CI. Use tokens and sessions to review what has access, and the revoke commands to remove what should not.

Command	What it does
`login`	Sign this machine in, by approval in a browser or with a token
`logout`	Forget the stored credential, and revoke its token when the CLI minted it
`me`	Show the account and permissions this machine is signed in with
`sessions`	List the browsers signed in to this account
`session:rm`	Sign one browser out
`tokens`	List your own machine tokens
`token:rm`	Revoke one of your own machine tokens
`sign-out-everywhere`	Sign every browser out of this account

Every command also takes --json, --quiet and --help. The shortcuts stechbd login, stechbd logout and stechbd me run auth login, auth logout and auth me.

stechbd auth login

Signs this machine in to the panel. Without --token, the CLI prints a code and waits while you approve it from a browser you are already signed in to, then stores the credential. With --token, it stores the token you pass and does not wait for anyone; use this in CI, with a token minted in the panel with the permissions you chose. Sign-in is refused over plain http, before anything is sent.

bash

stechbd auth login [--token <token|->] [--no-browser]

Option	Description
`--token <token\|->`	Sign in with this token instead of the browser approval. Pass `-` to read the token from stdin.
`--no-browser`	Print the approval link and code, but do not open a browser for the link. Ignored with `--token`.

bash

# Approve in a browser on this machine
stechbd auth login

# CI: read the token from the environment, without writing it to the shell history
echo "$STECHBD_TOKEN" | stechbd auth login --token -

stechbd auth logout

Forgets the stored credential on this machine. If the CLI minted the token during sign-in, it also revokes that token on the panel. A token added with login --token is only forgotten locally, because CI may still hold it. Running logout when nothing is stored is not an error.

bash

stechbd auth logout [--all]

Option	Description
`--all`	Forget every stored credential, not only the one this command would otherwise use.

Warning

--all clears every stored credential on this machine. Each one the CLI minted is revoked on the panel, so anything that relied on those tokens stops working.

bash

stechbd auth logout
stechbd auth logout --all

stechbd auth me

Shows the account and permissions that this machine is signed in with. Run it to confirm which identity a script or CI job will act as before it makes a change.

bash

stechbd auth me

bash

# Same command, shortcut form
stechbd me

stechbd auth sessions

Lists the browsers signed in to your account. Use it to find the session id that session:rm takes.

bash

stechbd auth sessions

bash

# Find the id of the session to sign out
stechbd auth sessions

stechbd auth session:rm

Signs one browser out of your account. Get the session id from auth sessions. The command asks for confirmation first, unless --yes is passed.

bash

stechbd auth session:rm <session> [--yes]

Option	Description
`<session>`	The session id, as printed by `auth sessions`. Required.
`--yes`	Skip the confirmation prompt.

bash

stechbd auth session:rm 3f9c2a --yes

stechbd auth tokens

Lists your own machine tokens, with each token’s name, state, last use and expiry. Use it to find the id that token:rm takes, and to spot a token that is unused or no longer needed.

bash

stechbd auth tokens

stechbd auth token:rm

Revokes one of your own machine tokens. Get the id from auth tokens. Use it when a token is no longer needed, or may have leaked. The command asks for confirmation first, unless --yes is passed.

bash

stechbd auth token:rm <token> [--yes]

Option	Description
`<token>`	The token id, as printed by `auth tokens`. Required. Only your own tokens can be named.
`--yes`	Skip the confirmation prompt.

Warning

A revoked token stops working everywhere it is held, including CI jobs that use it. Check auth tokens for the name before you revoke.

bash

stechbd auth token:rm 8d41e0 --yes

stechbd auth sign-out-everywhere

Signs every browser out of your account. Machine tokens are not sessions, so they keep working, including the one this machine uses. Use token:rm to revoke a token. The command asks for confirmation first, unless --yes is passed.

bash

stechbd auth sign-out-everywhere [--yes]

Option	Description
`--yes`	Skip the confirmation prompt.

bash

stechbd auth sign-out-everywhere --yes