Overview
cli-auth
Section titled “cli-auth”Browser-mediated CLI sign-in. The CLI starts a ceremony, the browser
completes whatever authentication the account requires, and the CLI
exchanges proof of possession for a session credential. Endpoints under
/v1/auth/cli/* are unauthenticated by design: they carry no bearer,
only single-use codes. Endpoints under /v1/cli/* are session-only:
API keys and named access keys are rejected with a plain 403. The
ceremony itself (/v1/cli/authorizations/*
and /v1/cli/activate) additionally requires a dashboard login session
(credential_origin of dashboard_session). A valid CLI session
(cli_browser or cli_device) or a session that predates credential
attribution is refused with 403 and code dashboard_session_required.
/v1/cli/devices* stays open to any login session so a terminal can
list and revoke its own credential.