CLI authentication.

Choose a flow

Interactive login is the simplest default for local work. Headless OAuth is for CI, bots, containers, and other environments where a browser cannot remain attached. Both flows end with an OAuth access token; they differ in how the session is established and refreshed.

Interactive browser login

Run login from your own machine. The CLI opens the browser, saves a local OAuth session, and uses it for subsequent memory and workspace commands.

empirical auth login
empirical doctor

• Install the CLI first →
• OAuth details →

Headless authentication

Bootstrap on a trusted machine or through the supported account flow, then provide the generated environment to CI or a container. Refresh in automation; never commit the generated env file or print secrets in logs.

empirical oauth bootstrap headless --write-env
empirical oauth refresh headless --write-env
empirical oauth bootstrap docker --print-access-token

• Production CI runbook →
• Bot setup →