Authentication

Three commands manage the CLI's session against api.wardkey.app: login, whoami, and logout. All three accept the global flags.

wardkey login

Run a one-time OIDC-style device flow against the API.

wardkey login

What happens:

1. 1
   1. The CLI requests a device + user code from the API.
   2. It prints a verification URL of the form https://console.wardkey.app/cli/approve?user_code=ABCD-EF23 and tries to open your default browser at it.
   3. Confirm the user code shown in the browser matches the one in your terminal, then click Approve.
   4. The CLI's next poll mints a bearer token and stores it in your OS keyring.

After login, the token is reused automatically by every subsequent command. No further interaction is required.

Pointing at a different API

wardkey login --api http://localhost:8787

--api is global and persists for the lifetime of the command. To make it permanent, set it in config.toml or export WARDKEY_API.

Where the token lives

Tokens are stored via 99designs/keyring, which picks a platform-native backend:

wardkey whoami

Hit GET /v1/me with the stored token and print the resolved identity.

wardkey whoami
# user_id:  usr_2pK...
# email:    you@example.com
# orgs:     org_abc (admin), org_xyz (member)

With --json, the same data comes back as a structured payload:

wardkey whoami --json

Useful for scripts that need to assert the active org before continuing.

wardkey logout

Remove the wardkey-cli entry from your OS keyring. Idempotent — a second logout with no token present is a no-op.

wardkey logout