SkyState

sky login, logout, and project auth ​

This page covers developer CLI login/logout and the sky project auth settings commands for end-user hosted auth.

sky login ​

Start the hosted developer login flow.

bash
sky login

sky login opens the hosted PKCE login flow. After successful authorization, the CLI stores the SkyState developer bearer session in ~/.config/skystate/token.json.

If a valid session already exists, interactive terminals are prompted before re-authenticating. Non-interactive sessions keep the existing valid session.

Global flags such as --quiet, --verbose, --api-url, and --auth-url are accepted.

sky logout ​

Clear the local developer session and best-effort revoke its refresh session server-side.

bash
sky logout

The command deletes local credentials first, then starts server-side logout without blocking local logout.

Project Auth Settings ​

sky project auth configures hosted auth for end users of your app.

bash
sky project auth show [--project <slug>]
sky project auth enable [--project <slug>]
sky project auth disable [--project <slug>]
sky project auth callback-urls list [--project <slug>]
sky project auth callback-urls add [--project <slug>] --url <url> --env <env>
sky project auth callback-urls remove [--project <slug>] --url <url> --env <env>

--project is optional for these commands because the CLI can prompt you to choose a project when a TTY is available. Use --project <slug> in scripts.

Callback URL environments accept development, staging, production, or aliases dev, stg, prod.

Advanced Provider Commands ​

The identity-provider subtree is available for advanced auth configuration:

bash
sky project auth providers list [--project <slug>]
sky project auth providers add [--project <slug>] --provider <provider>
sky project auth providers remove [--project <slug>] --provider <provider>

Valid provider values are google and github. The remove command refuses to remove the last configured provider.