Authentication
Requests carry a bearer token:
Authorization: Bearer <token>Tokens are scoped to an install, not to you
Section titled “Tokens are scoped to an install, not to you”This is the design decision worth understanding, because everything else follows from it. A token belongs to one machine or one integration, not to a person.
Sign in on your laptop and your CI runner and you have two tokens, not one shared between them. When the laptop is lost, you revoke that token and CI keeps running. One key per door beats one key for the building.
Getting a token
Section titled “Getting a token”The CLI does the whole exchange for you:
omazy auth login --email you@example.comYou get a one-time code by email, the CLI exchanges it, and the resulting token is scoped to that machine. There is no browser step, which is what lets this work over SSH and inside containers where opening a browser is not a thing that can happen.
Revoking
Section titled “Revoking”Revoke the install, not the account. Revoking one token leaves every other session working, which is what you want when a laptop goes missing and what you very much do not want to discover you cannot do at 2am.
What a rejected token looks like
Section titled “What a rejected token looks like”An expired or revoked token comes back as a failure with a stable error code rather than a prose message. Branch on the code, never on the text. Messages get rewritten by people improving the wording; codes do not.
See Platform for the full list.