The auth command group allows you to manage your CLI authentication state and verify your active session.

ennote auth [command]

Available Commands:
  login       Authenticate your CLI session via the Ennote Web UI
  logout      Clear the active Ennote session from your local machine
  status      View your current authentication status

1. Interactive SSO (Local Development)

Start the interactive authentication process. This is the standard approach for local developer machines.

ennote auth login

Security & Behavior

• Browser Integration: Opens the system browser to authenticate via Google/Microsoft/GitHub SSO.
• Local Handshake: Binds to a local callback port to receive the session token.
• Zero Persistence: Validates anti-CSRF state parameters and securely stores the token in the OS Keyring, never writing it to disk in plaintext.

2. Headless Token (CI/CD Pipelines)

For automated environments, you can bypass interactive login by setting the ENNOTE_TOKEN environment variable. This overrides the OS Keyring entirely and is the required method for headless execution.

export ENNOTE_TOKEN="your_machine_identity_token"

You can verify your current authentication state, token source, and expiration time using the status command.

ennote auth status

Example Output:

Ennote CLI Authentication Status
--------------------------------
Status:         Expired
Source:         OS Keyring
Account:        Demo User ([email protected])
Provider:       google.com
Expired At:     2026-06-16 08:52:29

Your session has expired. Please run 'ennote auth login' to authenticate.

To securely remove your active session and wipe the tokens from your local machine's OS Keyring, run the logout command.

ennote auth logout