grafos login

Browser-loopback or device-code login against the Tenura account API.

grafos login

Browser login against Tenura-hosted accounts. Opens the hosted login page in a browser, waits on a loopback callback, exchanges the authorization code for a tenant-scoped credential, and persists it

Usage: grafos login [OPTIONS]

Options:
      --api-url <API_URL>            Override the Tenura account API origin. Default `https://api.tenura.systems`. Overrides `GRAFOS_LOGIN_API_URL` [env: GRAFOS_LOGIN_API_URL=]
      --fabric <FABRIC>              Fabric address (host:port). Overrides GRAFOS_FABRIC env var [env: GRAFOS_FABRIC=]
      --json                         Output in JSON format for scripting
      --no-browser                   Print the browser URL and wait for the loopback callback, but don't try to launch a browser (SSH / CI / locked-down desktops). will add a true device-code path; this flag is the friendly intermediate
      --scopes <SCOPES>              Comma-separated scope names to request. Defaults to `tenant_user,dashboard_read,cloud_run`. Anything not in the Tenura Scope enum will be refused with HTTP 403 `scope_denied` server-side; the CLI does not pre-filter
      --wide                         Show additional columns in table output
      --no-color                     Disable color output
      --port <PORT>                  Override the loopback bind port. Default `0` lets the OS pick an ephemeral port. Useful if a corporate firewall only allows one specific port back to the workstation. Ignored when `--device-code` is set [default: 0]
      --pool <POOL>                  Pool name (default: "default") [default: default]
      --timeout-secs <TIMEOUT_SECS>  Maximum seconds to wait for the browser callback before giving up. Default 300s — comfortably longer than the hosted page's email round-trip but short enough that a stalled login fails cleanly. Also bounds device-code polling [default: 300]
      --device-code                  device-code flow. Use when the CLI host can't bind a loopback listener (SSH on a remote box, CI runner with no localhost browser, kiosk, etc.). The CLI requests a `user_code` + `verification_uri_complete` from Tenura, prints both, and polls `/v1/login/token` until the user authorizes the flow on a different device
  -h, --help                         Print help
  -V, --version                      Print version