Authentication

The development cloud service requires an Auth0 tenant and a provisioned Banh account. Operators configure these through the private banh-cloud/AUTH0.md guide. There is no public signup flow yet.

Developer login

banh login --api-url http://127.0.0.1:3000
banh whoami

Login discovers public Auth0 settings at /v1/auth/config, opens your browser, and polls for an access token. Use --no-browser to print the authorization instructions without launching a browser. No client secret is used.

The CLI verifies the token with /v1/me before saving it. Changing API URLs does not forward a saved token to another server.

Credential types

Credential	Permitted operations
Auth0 user access token	Identify the user; deploy, invoke, list, and inspect workflows within authorized accounts.
Banh invocation key (banh_sk_...)	Invoke workflows within its account only.

Send either type using Authorization: Bearer <credential>. BANH_API_TOKEN must contain a valid Auth0 user access token for developer CLI commands. Old banh_dev_... credentials are not accepted.

Invocation keys are issued during provisioning, printed once, and stored as hashes by the service. Keep them on your application server; do not put them into browser code or static site configuration.

Credential storage

Saved CLI credentials are plaintext in a private local JSON file, with owner-only permissions on Unix:

Platform	Path
Linux	$XDG_CONFIG_HOME/banh/config.json or ~/.config/banh/config.json
macOS	~/Library/Application Support/banh/config.json
Windows	%APPDATA%/banh/config.json

BANH_CONFIG_DIR overrides the configuration directory. Credentials are not stored in an OS keychain. Refresh tokens are not stored in this revision; repeat login after expiration.

CI and logout

Set BANH_API_URL, BANH_API_TOKEN, and optionally BANH_ACCOUNT_ID to use whoami and deploy without saving a login. See configuration precedence.

banh logout

Logout removes the saved login locally. It does not revoke the access token, end your Auth0 browser session, or unset environment variables. Contact the service operator to revoke an invocation key or disable account access.