Log in

okibi stores one secret: your Okibi API key. Logging in creates that key for this machine.

Terminal

okibi auth login

Your browser opens, you approve the request, and the terminal continues on its own. No account yet? okibi auth signup runs the same flow and signs you up with GitHub.

Check who you are logged in as:

Terminal

okibi auth status

Where the key is stored

The key goes into your OS keyring under the service okibi-client. When no keyring is available, such as on a headless Linux box or with OKIBI_NO_KEYRING=1, it is written to ~/.config/okibi/config.json with owner-only permissions.

okibi picks the key in this order: OKIBI_API_KEY, then the keyring, then the config file. A key in OKIBI_API_KEY wins over your login, so check it first if okibi acts as the wrong account.

Keys for CI

Create a key that is locked to one workspace, so a leaked CI secret can't touch your other workspaces:

Terminal

okibi keys create --name github-actions --workspace acme

The key is printed once. Store it as a CI secret named OKIBI_API_KEY. Locked keys can't create workspaces, target another workspace, change membership, manage keys, or manage billing. See API keys.

List and revoke keys:

Terminal

okibi keys list
okibi keys revoke <key-id>

Connect GitHub

Private repositories need the Okibi GitHub App on the account that owns them:

Terminal

okibi auth github

Publishing a CLI's source into your own GitHub account uses a separate app with write access, connected with okibi auth publisher.

Log out

Terminal

okibi auth logout

This removes the key from this machine only. It does not unset OKIBI_API_KEY in your shell.