Auth Commands

Manage authentication for Treasure AI. Supports both browser-based OAuth and API key authentication.

tdx auth                    # Show authentication status
tdx auth status             # Alias for tdx auth
tdx auth setup              # Setup authentication interactively
tdx auth token              # Print the OAuth access token
tdx auth clear              # Remove credentials from system keychain

Display current authentication status and validate credentials:

tdx auth
tdx auth --profile prod

Shows the active profile, credential type (OAuth or API key), and validates by calling the TD API.

Interactive authentication setup. Choose between browser-based OAuth (recommended) or API key:

tdx auth setup
tdx auth setup --site ap01
tdx auth setup --profile prod
tdx auth setup --account-name td7060   # SSO login for a specific account

1. Select your Treasure AI site
2. Choose "Sign in with browser"
3. Optionally enter an account name for SSO routing
4. Browser opens for authentication
5. After login, tokens are saved to system keychain

OAuth tokens are stored securely in the system keychain and used automatically for subsequent commands.

1. Select your Treasure AI site
2. Choose "Use an API key"
3. Enter your API key (found at Console > API Keys)
4. Key is validated and saved to system keychain

tdx auth token prints only the raw OAuth access token followed by a newline. It is intended for tools that support command-based bearer authentication, such as Codex. The command does not print status messages on stdout; errors are written to stderr.

tdx auth token
tdx auth token --profile production

The command reads profile-specific environment tokens before keychain credentials. Keychain OAuth credentials are refreshed when they are expired or within five minutes of expiry, and refreshed credentials are saved back to the system keychain. API keys are not printed or treated as bearer tokens.

In the rare case that the stored token is known-expired and the keychain has no refresh token to renew it with — a corrupted or partially initialized entry — the command exits non-zero with UNAUTHENTICATED instead of printing a stale bearer, and points you at tdx auth setup. This is not something a normal tdx auth setup flow leaves behind. Legacy keychain entries written before token-expiry tracking existed are accepted as-is.

Remove all credentials (API key and OAuth tokens) from the system keychain:

tdx auth clear
tdx auth clear --profile prod