auth

Authentication uses the OAuth device flow. You run datagen auth login, open a browser, confirm, and the CLI stores a token locally. Every other command picks it up from the credentials file automatically.

Where credentials live

The CLI writes a single credentials file at:

~/.config/datagen/credentials.json

File permissions are set to 0600. The file holds the bearer token, the signed-in email, the active organization slug, and the time it was stored. datagen auth logout deletes it; reinstalling the CLI does not.

Treat credentials.json like any other API key — don't commit it, don't share it. If a token leaks, run datagen auth logout from a machine that has the token to revoke it.

Authenticate via the device flow. The command prints a short user code and opens your browser to confirm; once you approve, it writes the token to ~/.config/datagen/credentials.json.

datagen auth login

Flags

Flag	Type	Default	Description
`--format`	`text`\|`json`	`text`	Output format.

Example

$ datagen auth login
User code: QXTR-9PLN
Verify at: https://datagen.example/device
Opening: https://datagen.example/device?user_code=QXTR-9PLN

status: authenticated
email: you@yourcompany.com
active_org_slug: yourcompany

The CLI polls the API until you approve, back off if the server asks, and times out after the server's expires_in if you don't.

auth logout

Revoke the current session server-side and delete the local credentials file.

datagen auth logout

Flags

Flag	Type	Default	Description
`--format`	`text`\|`json`	`text`	Output format.

If no local credential exists, the command exits cleanly with status: no_credential.

auth status

Print the signed-in user, active organization, and your role there.

datagen auth status

Flags

Flag	Type	Default	Description
`--format`	`text`\|`json`	`text`	Output format.

Example

$ datagen auth status
email: you@yourcompany.com
active_org_slug: yourcompany
role: admin

auth org

List the organizations you're a member of, or switch the active one.

datagen auth org --list
datagen auth org --use <slug>

Exactly one of --list or --use must be set.

Flags

Flag	Type	Default	Description
`--list`	flag	off	List your organization memberships.
`--use`	string	`None`	Switch the active organization to the given slug.
`--format`	`text`\|`json`	`text`	Output format.

Switching orgs updates active_org_slug in the credentials file. Every subsequent command scopes to that organization.

Example

$ datagen auth org --list
active_org_slug: yourcompany
memberships:
  - yourcompany (admin, active)
  - test-org (member)

$ datagen auth org --use test-org
email: you@yourcompany.com
active_org_slug: test-org
role: member

On this page