Headless & CI operations.

Bootstrap model

Bootstrap once on a trusted machine and store refresh values in a secret manager. Generate the environment file locally, then inject its values into the CI job rather than committing the file.

empirical oauth bootstrap headless --write-env
# Store the generated values in your CI secret manager

Refresh loop

Refresh access tokens at runtime before expiry in every CI execution path. A job should fail clearly on auth errors instead of retrying a write indefinitely.

empirical oauth refresh headless --write-env

Safety controls

Never log secrets or refresh tokens. Rotate credentials on role transitions, scope automation to the required workspace, and use a dry-run or read check before enabling writes.

Not for local browsers: Use empirical auth login for an interactive developer machine; headless credentials are for automation and containers.