CLI Authentication

The RevKeen CLI supports two authentication modes — an interactive OAuth login for humans, and API keys for scripts and CI. Credentials are stored in ~/.revkeen/config.toml.

Credential precedence

The CLI resolves a key in this order:

1. --api-key flag (for a single invocation)
2. REVKEEN_API_KEY environment variable
3. API key stored in ~/.revkeen/config.toml
4. OAuth access token from revkeen auth login

Option 1 — OAuth login (recommended for humans)

revkeen auth login

This runs an OAuth device flow: the CLI prints a verification URL and code, you approve it in the browser, and the resulting tokens are saved to ~/.revkeen/config.toml. Check status anytime:

revkeen auth status
revkeen auth logout   # clears stored credentials

Option 2 — API key (recommended for scripts & CI)

API keys start with rk_live_ (production) or rk_sandbox_ (staging). Store one in the config file, or pass it via environment variable.

revkeen config set api-key rk_live_your_api_key
revkeen customers list

export REVKEEN_API_KEY=rk_live_your_api_key
revkeen customers list

revkeen customers list --api-key rk_live_your_api_key

On Windows PowerShell, set the environment variable with:

$env:REVKEEN_API_KEY = "rk_live_your_api_key"

Targeting staging

The CLI defaults to production (https://api.revkeen.com). Point it at another environment via config:

# Convenience: switch to the staging base URL
revkeen config set environment staging

# Or set an explicit base URL
revkeen config set base-url https://staging-api.revkeen.com

Use a rk_sandbox_* key with staging:

revkeen config set environment staging
revkeen config set api-key rk_sandbox_your_api_key
revkeen invoices list

CI usage

Provide the API key as a secret-backed environment variable:

- name: List invoices
  env:
    REVKEEN_API_KEY: ${{ secrets.REVKEEN_API_KEY }}
  run: revkeen invoices list --json

Security guidance

• Use sandbox keys for development; reserve live keys for production operations.
• Prefer environment variables or a secret manager over copy-paste on shared machines.
• ~/.revkeen/config.toml is written with owner-only permissions — keep it that way.
• Rotate keys regularly from the RevKeen dashboard and avoid echoing them into logs or shell history.

See also