Skip to main content

​
Authentication and context

​
Interactive browser login

The CLI starts a localhost callback on an available port, creates a CSRF state, opens the browser, and prints the URL for manual use if the browser cannot open. After authentication it stores the user-scoped cli_ token in ~/.superflag/credentials.json with mode 0600; the directory is mode 0700.

​
Noninteractive token resolution

The CLI resolves credentials in this order:
  1. SUPERFLAG_TOKEN
  2. --token-file or SUPERFLAG_TOKEN_FILE
  3. browser-login credentials in ~/.superflag/credentials.json
Use your CI platform’s secret injection for SUPERFLAG_TOKEN. Do not print or copy the credentials JSON into logs. Token files must be current-user-owned regular files, not symlinks, with mode 0600 or stricter:
The second command creates or truncates the token file. Do not run it after a secret manager has populated the file unless replacing that token is intended.

​
Select app and environment

Saved context lives in ~/.superflag/context.json. For agents and CI, explicit selectors are easier to audit and prevent accidental cross-environment work:
Missing, misspelled, or access-filtered targets fail closed as not_found. Duplicate human-readable app names fail as ambiguous_target and include immutable-ID remediation; the CLI never selects the first match or substitutes a similarly named target.

​
Credential scope

cli_ tokens are user-scoped. admin_ keys are app-scoped and can authenticate management automation. sdk_ and pub_ keys are environment-scoped delivery credentials, not general CLI login tokens.