Authentication

Sign in to the revenexx CLI with a token, understand how credentials resolve from flags, environment, and config files, and select the tenant your commands apply to.

The CLI authenticates with a token. Every session uses a gateway API key — there is no email/password flow. You create the key in the customer console, then hand it to the CLI through a flag, an environment variable, or a config file.

Sign in

Run login. The CLI resolves a token, validates it against the gateway, and saves it so later commands don't have to repeat it.

Shell
revenexx login

With no flags, login looks for a token in this order: the --token flag, the REVENEXX_API_KEY environment variable, then a .revenexx.yaml file in the current directory tree. If it finds one, it validates the token against the gateway and persists it to ~/.revenexx/prefs.json. If it finds none, it stops and tells you how to supply one.

For CI and scripts, pass the token and tenant directly:

Shell
revenexx login --token <token> --tenant <slug>

The request the CLI makes carries your key as X-Revenexx-Api-Key and the tenant as X-Revenexx-Tenant, against https://api.revenexx.com.

Credential resolution order

Any command that needs auth resolves its credentials the same way. The first source that has a value wins:

  1. CLI flag — --token, --endpoint, --tenant
  2. Environment variables — REVENEXX_API_KEY, REVENEXX_API_URL, REVENEXX_TENANT
  3. Project file — the nearest .revenexx.yaml, walking up from the current directory
  4. Global config — ~/.revenexx/prefs.json, written by revenexx login
  5. Built-in default — the endpoint defaults to https://api.revenexx.com

The tenant slug has its own precedence: the --tenant flag, then the value set by tenants use (stored in ~/.revenexx/tenant), then REVENEXX_TENANT, then .revenexx.yaml.

Select a tenant

tenants scopes your commands to one tenant. Set it once and every later command applies there.

Shell
revenexx tenants use <slug>

When a key is available, use validates the slug against the gateway first and rejects a tenant the key can't reach. Pass --force to set it anyway.

Check or list what's active:

Shell
revenexx tenants current
revenexx tenants current --check
revenexx tenants list
  • tenants current prints the active slug; --check verifies it against the gateway.
  • tenants list shows every tenant this machine knows about — from flags, environment, .revenexx.yaml, the saved slug, and login sessions — along with where each came from and whether your current key can reach it.

What's next

Was this page helpful?