CLI Authentication

The CLI supports three ways to sign in, plus the REVKEEN_API_KEY environment variable for scripts and CI. Choose the environment first, then sign in:

revkeen config set environment staging
revkeen login
revkeen auth status

revkeen auth login is the same command as revkeen login.

Sign-in methods

Browser

revkeen login

The CLI opens your browser to sign in to RevKeen and approve access, and receives the result on a local 127.0.0.1 callback. Sign in as the user and merchant you intend to use. If the CLI cannot open a browser, add --no-browser to print the URL instead.

Device code

revkeen login --device

The CLI prints a verification URL and a code. Open the URL on any device, sign in, and enter the code. Add --no-browser to stop the CLI trying to open the URL locally.

API key

revkeen login --api-key

Paste a secret key from the dashboard at the prompt: rk_sandbox_* for staging, rk_live_* for production. Keys are the same merchant credentials used for REST and SDK requests; the CLI does not issue its own keys.

To supply a key or access token without an interactive prompt, pipe it in or set REVKEEN_ACCESS_TOKEN and use --with-token:

revkeen login --with-token < path/to/key-file

Avoid typing secrets as command-line arguments: they can be saved in shell history and are visible to other processes.

What each method can do

Browser and device sign-in grant read access to customers, invoices, payments, orders, subscriptions, products, prices, and analytics. Browser sign-in also lets you issue Cart keys with revkeen cart keys issue, if your role in the merchant allows it. Neither grants webhook access or general write access.

Use a secret API key with the required access for:

• revkeen listen and revkeen trigger
• commands that create, update, or cancel resources
• CI and unattended scripts

A 403 response with Missing required scopes means the current credential does not cover the command. Sign in with an API key that does, or ask a merchant administrator for access.

Where credentials are stored

Settings are stored in ~/.revkeen/config.toml. Secrets (API keys and OAuth tokens) are stored in your operating system's keyring. If no keyring is available, they are written to ~/.revkeen/credentials.toml with owner-only permissions. Treat both files as secrets and do not copy them between machines, merchants, or environments.

Credential precedence

When more than one credential is available, the CLI uses the first of:

1. the global --api-key flag
2. the REVKEEN_API_KEY environment variable
3. an API key stored by revkeen login --api-key
4. an OAuth session from browser or device sign-in

A leftover REVKEEN_API_KEY therefore overrides your browser sign-in. Run revkeen auth status to see which credential is in use before running a command that changes data.

CI authentication

Supply the API key from your CI provider's secret store, never as a literal in the workflow:

- name: Install RevKeen CLI
  run: npm install -g @revkeen/cli-binary@0.3.0
- name: Read staging customers
  env:
    REVKEEN_API_KEY: ${{ secrets.REVKEEN_STAGING_API_KEY }}
  run: |
    revkeen config set environment staging
    revkeen api GET /v2/customers --agent

Pin the version you tested. Use a dedicated key for CI with only the access it needs. API keys do not bypass RevKeen authorization, merchant isolation, or scope restrictions.

Switching environments

Changing the environment does not change your credential. Sign in again, or replace the key, when you switch, then check revkeen auth status.

Sign out and revoke

revkeen auth logout

Logout removes stored credentials from the keyring or credentials file. Also remove REVKEEN_API_KEY from your shell or CI configuration when you no longer need it. Revoke a compromised or retired key in the dashboard: deleting local credentials does not revoke a key at the API.

MCP uses its own browser sign-in, separate from the CLI.

Troubleshooting

Continue with the command reference.

Owner: david · Reviewed 30 Sep 2026 · Next review 30 Oct 2026