|
| 1 | +--- |
| 2 | +title: Authentication |
| 3 | +description: Log in, manage tokens, work with multiple backends, and authenticate in CI |
| 4 | +--- |
| 5 | + |
| 6 | +## Device flow login |
| 7 | + |
| 8 | +The CLI uses a device authorization flow — you approve the login from a browser, no password is typed into the terminal. |
| 9 | + |
| 10 | +```sh |
| 11 | +photon login |
| 12 | +``` |
| 13 | + |
| 14 | +This opens your default browser to the Photon approval page. Once you approve, the CLI stores your access token locally and you're ready to go. |
| 15 | + |
| 16 | +If you're on a headless machine (SSH session, container), pass `--no-browser` to get a URL you can open elsewhere: |
| 17 | + |
| 18 | +```sh |
| 19 | +photon login --no-browser |
| 20 | +``` |
| 21 | + |
| 22 | +## Verify your session |
| 23 | + |
| 24 | +```sh |
| 25 | +photon whoami |
| 26 | +``` |
| 27 | + |
| 28 | +Prints your user ID, email, and name. If the session has expired, you'll see a hint to re-run `photon login`. |
| 29 | + |
| 30 | +## Log out |
| 31 | + |
| 32 | +```sh |
| 33 | +photon logout |
| 34 | +``` |
| 35 | + |
| 36 | +Revokes the session on the server and deletes the local credential file. |
| 37 | + |
| 38 | +## Credential storage |
| 39 | + |
| 40 | +Credentials are stored as JSON files with `600` permissions: |
| 41 | + |
| 42 | +``` |
| 43 | +$PHOTON_CONFIG_DIR/credentials/<backend-key>.json |
| 44 | +``` |
| 45 | + |
| 46 | +The config directory is resolved in this order: |
| 47 | + |
| 48 | +1. `$PHOTON_CONFIG_DIR` — explicit override |
| 49 | +2. `$XDG_CONFIG_HOME/photon` — XDG standard |
| 50 | +3. `~/.config/photon/` — default |
| 51 | + |
| 52 | +<Note> |
| 53 | +If a legacy `~/.config/photon-dashboard/` directory exists from a prior install, it migrates automatically on first run. |
| 54 | +</Note> |
| 55 | + |
| 56 | +### Multi-backend credentials |
| 57 | + |
| 58 | +Credentials are stored **per backend**. You can be logged into production and a staging server simultaneously — each gets its own credential file keyed by a sanitized hostname (e.g. `production`, `staging-app_photon_codes`, `localhost_3000`). |
| 59 | + |
| 60 | +```sh |
| 61 | +# Log in to production (default) |
| 62 | +photon login |
| 63 | + |
| 64 | +# Log in to staging |
| 65 | +photon login --api-host https://staging-app.photon.codes |
| 66 | + |
| 67 | +# Check all backends at once |
| 68 | +photon auth status |
| 69 | +``` |
| 70 | + |
| 71 | +`photon auth status` shows the login state for every backend you've authenticated against. Pass `--json` for machine-readable output. |
| 72 | + |
| 73 | +## Backend host |
| 74 | + |
| 75 | +Every command talks to a backend URL. The default is production (`https://app.photon.codes`). To target a different backend, set `PHOTON_API_HOST` or use the `--api-host` flag: |
| 76 | + |
| 77 | +```sh |
| 78 | +# Environment variable — applies to every command in this shell |
| 79 | +export PHOTON_API_HOST=https://staging-app.photon.codes |
| 80 | +photon projects ls |
| 81 | + |
| 82 | +# Per-command flag |
| 83 | +photon projects ls --api-host https://staging-app.photon.codes |
| 84 | + |
| 85 | +# Inline |
| 86 | +PHOTON_API_HOST=http://localhost:3000 photon projects ls |
| 87 | +``` |
| 88 | + |
| 89 | +Resolution order: `--api-host` flag > `PHOTON_API_HOST` env var > built-in production URL. |
| 90 | + |
| 91 | +Check the resolved host with: |
| 92 | + |
| 93 | +```sh |
| 94 | +photon env current |
| 95 | +``` |
| 96 | + |
| 97 | +## Setting an active project |
| 98 | + |
| 99 | +Most commands operate on a single project. Specify it per-command or per-shell: |
| 100 | + |
| 101 | +```sh |
| 102 | +# Per command |
| 103 | +photon spectrum users ls --project abc123 |
| 104 | + |
| 105 | +# Per shell session |
| 106 | +export PHOTON_PROJECT_ID=abc123 |
| 107 | +photon spectrum users ls |
| 108 | +``` |
| 109 | + |
| 110 | +Resolution order: `--project` flag > `$PHOTON_PROJECT_ID` > error with a hint. |
| 111 | + |
| 112 | +<Note> |
| 113 | +Put `export PHOTON_PROJECT_ID='...'` in your shell rc, or use [direnv](https://direnv.net/) to scope it to a project directory. |
| 114 | +</Note> |
| 115 | + |
| 116 | +## CI and scripting |
| 117 | + |
| 118 | +For non-interactive environments, pass a token directly instead of running the device flow: |
| 119 | + |
| 120 | +```sh |
| 121 | +# Flag |
| 122 | +photon projects ls --token "$PHOTON_TOKEN" |
| 123 | + |
| 124 | +# Environment variable |
| 125 | +PHOTON_TOKEN=ey... photon projects ls |
| 126 | +``` |
| 127 | + |
| 128 | +Get the token from your local credentials file (under `$PHOTON_CONFIG_DIR/credentials/<key>.json`) after authenticating once with `photon login`. |
| 129 | + |
| 130 | +Pair with `--json` for machine-readable output: |
| 131 | + |
| 132 | +```sh |
| 133 | +photon projects ls --json | jq '.[] | .id' |
| 134 | +photon billing show --json |
| 135 | +``` |
| 136 | + |
| 137 | +| Flag / env var | Effect | |
| 138 | +|----------------|--------| |
| 139 | +| `-t, --token <token>` / `PHOTON_TOKEN` | Use this token instead of stored credentials | |
| 140 | +| `--json` | Structured JSON output | |
| 141 | +| `--yes`, `-y` | Skip destructive-action confirmation prompts | |
| 142 | +| `--no-browser` | Don't auto-open the browser | |
| 143 | + |
| 144 | +<Note> |
| 145 | +`PHOTON_TOKEN` reuses the access token from the device flow (default 7-day expiry). Re-run `photon login` when it expires. A long-lived API key path is on the roadmap. |
| 146 | +</Note> |
0 commit comments