Skip to main content
Before using the Detail CLI, authenticate with your Detail account. The CLI supports a browser-based OAuth flow for local development and direct token entry via --token for CI/CD pipelines or headless environments. For local development, run detail auth login to open a browser window and complete the OAuth flow:
The CLI opens https://app.detail.dev/cli-auth in your default browser. After you approve access, the CLI receives a token and saves it to ~/.config/detail-cli/config.toml. You’ll see a confirmation message like this one:
If your browser doesn’t open automatically, the CLI prints the full URL so you can paste it yourself.
The browser flow uses PKCE (RFC 7636) for security. No client secret is transmitted — the CLI binds a local callback listener to receive the authorization code.

Token-based login

For automated pipelines or environments without a browser, pass an API token directly using --token:
Tokens start with dtl_. Generate one in the Detail dashboard under Settings → API Keys.
In automated pipelines, e.g. in CI or in your software factory of choice, store the token in a secret and pass it via an environment variable to avoid hard-coding credentials:

Check authentication status

Verify that the CLI is authenticated and confirm which account is active:
If the stored token is invalid or has been revoked, detail auth status tells you to re-run detail auth login.

Log out

Remove the stored token from your machine:
This clears the api_token field from ~/.config/detail-cli/config.toml. It does not revoke the token in the Detail dashboard; do that in Settings → API Keys if needed.

Token storage

The CLI stores your token in ~/.config/detail-cli/config.toml (Linux and macOS) or %LOCALAPPDATA%\detail-cli\config.toml (Windows). The file is created with permissions that restrict access to your user account.
Do not commit config.toml to version control. Add ~/.config/detail-cli/ to your global .gitignore if you manage dotfiles in a public repository.

Authentication subcommands summary