Auth

PAT-management commands. The PAT is the credential es itself uses — distinct from the project API keys the SDK uses. For the high-level login walkthrough (and the device-authorization flow screenshot), see Authenticate below.

Commands

Command	What it does
es auth login [--no-browser]	Runs the RFC 8628 device-authorization flow. Shows a one-time code, opens the verification URL in your browser, and polls until you sign in and confirm. Saves the resulting PAT to ~/.config/everscribe/pat.json (mode 0600). --no-browser skips opening the browser — useful over SSH.
es auth logout	Revokes the PAT server-side and removes the local session file. Tolerant of stale tokens — local cleanup always runs.
es auth whoami [--format ...]	Prints the user identity associated with the saved PAT. Never echoes the token itself.

Authenticate

es authenticates with a personal access token (PAT) you mint via the browser — distinct from the project API keys the SDK uses. The CLI itself walks you through the RFC 8628 device-authorization flow:

es auth login

What you'll see:

First copy your one-time code:

    PHJK-7M3X

Then open this URL in your browser (we'll try to open it for you):

    https://everscribe.io/cli/verify

Waiting for authorization... (press Ctrl+C to cancel)
Logged in as [email protected].

Opening the URL lands you on the Authorize the Everscribe CLI page where you paste the one-time code and click Authorize — the CLI is polling and finishes the moment the browser confirms.

The PAT is persisted to ~/.config/everscribe/pat.json (mode 0600). Default lifetime is 90 days; manage tokens (or mint one with a different expiry) on Developer Settings.

Use --no-browser when you're SSHed into a remote host — the CLI prints the code and URL so you can sign in from a browser on any device.

Where the PAT lives

Saved to ~/.config/everscribe/pat.json (mode 0600). Default lifetime is 90 days; manage tokens (or mint one with a different expiry) on Developer Settings. es auth logout is safe to run when the token is already invalid — local cleanup runs unconditionally.