Sign in with the CLI

First-time setup

Run:

ivk init

The CLI starts device authorization and opens the browser. Complete sign-in in the browser, then return to the terminal. If the account has no workspace, the CLI asks for a workspace name and creates it before saving the session.

To supply the first workspace name in the command:

ivk init --workspace-name "Acme reliability"

Use --no-browser when the CLI should print the authorization URL and code without opening a browser:

ivk login --no-browser

Confirm the session

ivk whoami
ivk status

whoami shows the signed-in user, active workspace, role, and workspace ID. status, or st, shows current readiness and the next action.

Work with several workspaces

ivk workspaces list
ivk ws switch org_123
ivk whoami

Switch uses the organization ID shown by ivk ws list. It obtains a signed session for that organization before changing the active workspace.

Local credential storage

Interactive sign-in stores the session in the operating system keychain. If the keychain is unavailable, the CLI uses a user-only credentials file with mode 0600 under the Invokeable configuration directory.

Production and staging credentials are isolated from each other.

Sign out

ivk logout

Logout removes the CLI session from the keychain or fallback file. It does not sign out the web application or remove workspace data.

Short-lived automation tokens

Automation can provide a short-lived, workspace-bound token through INVOKEABLE_ACCESS_TOKEN. Do not store it in source control or print it in job logs. See Automation.