CLI authentication
The CLI supports browser login for people and scoped API keys for automation. Stored credentials are kept in the operating-system keychain rather than the CLI configuration file.
Browser login
Section titled “Browser login”champrep auth loginThe CLI creates a PKCE-protected approval request, opens the CHAMPREP sign-in experience, waits for approval, and stores the resulting short-lived credential in the keychain.
Use this mode for interactive work on a trusted workstation.
Headless browser approval
Section titled “Headless browser approval”On a remote terminal that cannot open a browser:
champrep auth login --no-browserOpen the displayed approval URL on a trusted browser, sign in, and approve the request before it expires. The terminal polls the Gateway at a bounded interval and completes after approval.
You can change the approval deadline:
champrep auth login --no-browser --timeout 15mConfirm the active identity
Section titled “Confirm the active identity”champrep auth whoamichamprep auth statusauth whoami displays the active identity and profile. auth status adds live
Gateway quota information and available audit context. Upstream sections can
be marked unavailable without invalidating a working local login.
Profiles and environments
Section titled “Profiles and environments”champrep auth listchamprep auth switch PROFILEchamprep config envProfiles represent roles or organizations available to the same account. A profile switch cannot cross into another account that has not been separately authenticated on the machine.
Use --env NAME to override the configured environment for one command:
champrep --env production auth whoamiDo not set an environment’s API URL to an individual service backend. The CLI requires a Gateway-compatible URL.
Sign out
Section titled “Sign out”champrep auth logoutUse --all to remove stored credentials across every configured environment.
Use --force only when a non-interactive workflow must skip confirmation.
champrep auth logout --allSigning out removes local keychain and profile state. Revoke an API key in the web dashboard when the key itself should stop working everywhere.
Automation
Section titled “Automation”For CI, cron, and unattended scripts, use a narrowly scoped API key instead of browser login. Continue with API keys for CLI automation.