Skip to main content

​
CLI Authentication

The CLI authenticates with either a browser OAuth session (device-code flow) or a stored API key / PAT. Either way, nexspace login saves the credential to your OS keychain when available (macOS Keychain, Linux Secret Service, Windows Credential Manager), falling back to ~/.nexspace/config.json (mode 0600).

​
Device Code Login (Interactive)

Best for personal use on your workstation:
This opens a browser where you log in and approve the CLI. The CLI refreshes the OAuth access token automatically as it nears expiry.

​
API Key / PAT (Headless)

Best for CI/CD, scripts, and automation. Store the key once with nexspace login --token — it also reads the NEXSPACE_API_KEY environment variable as a fallback for the token value:
Once stored, every command reuses the credential automatically:

​
Verify Authentication

Prints the identity the stored credential authenticates as, backed by GET /api/auth/me.

​
Logout

Removes stored credentials from the keychain and ~/.nexspace/config.json.