OAuth commands.

Interactive OAuth

Use the browser flow when a person is present. It is the recommended local-development path because the user approves access directly and the CLI stores the resulting session locally.

empirical auth login

Headless OAuth

Use headless bootstrap and refresh in CI, scheduled jobs, bots, or containers. Bootstrap establishes credentials; refresh obtains a current access token without opening a browser.

empirical oauth bootstrap headless --write-env
empirical oauth refresh headless --write-env

• Headless and CI security guidance →

Docker output

The Docker target is useful when a container entrypoint needs a token printed or passed into its environment rather than written to the host session.

empirical oauth bootstrap docker --print-access-token
empirical oauth refresh docker --print-access-token

• Production bot setup →

Advanced client helpers

Most users do not need these commands. They inspect or override cached client credentials for controlled integrations and troubleshooting.

empirical oauth client set --client-id <id> --client-secret <secret>
empirical oauth client show
empirical oauth client clear

Keep secrets out of shell history: Prefer environment injection or a secret manager for production credentials. Never paste client secrets into documentation, tickets, or chat.