auth

initializ auth authenticates the CLI against the platform. Both subcommands validate the token server-side — signature and revocation — not just a local JWT decode.

initializ auth login

Stores a platform access token (non-interactive). The token is validated server-side, then written together with the API URL, org id, and workspace id to ~/.initializ/config.yaml (created with 0600 permissions).

initializ auth login [--token-stdin] [--token <token>] --org <org_id> --api-url <url>

Tokens are minted by an org/workspace admin via the console with role developer or workspace_admin.

Behavior:

• The token can come from --token, --token-stdin, or INITIALIZ_TOKEN — if none is set, the command fails with exit code 2.
• If no workspace id was configured, the workspace scoped into the token (if any) is saved to the config file.
• Prefer --token-stdin over --token so the token stays out of shell history.

auth login flags

All global flags apply; --api-url, --org, --token, and --workspace are the relevant ones here.

auth login example

echo "$INITIALIZ_TOKEN" | initializ auth login \
  --token-stdin \
  --org org_a1b2c3 \
  --api-url https://api.initializ.ai

logged in as ci-bot@acme.com (org org_a1b2c3), config written to /home/dev/.initializ/config.yaml

The confirmation line goes to stderr and is suppressed by --quiet.

initializ auth whoami

Validates the token server-side and prints the resolved identity. This checks the token's signature and its revocation status — the fast-fail preflight for CI pipelines. An invalid or revoked token exits with code 3.

initializ auth whoami

auth whoami takes no flags of its own beyond the global flags.

auth whoami output

Text output is a table of the verified identity (the USER row shows the email when present, otherwise the user id; WORKSPACE appears only when a workspace is in scope):

USER       ci-bot@acme.com
ORG        org_a1b2c3
WORKSPACE  ws_a1b2c3de
API        https://api.initializ.ai

With -o json the raw verification response is printed:

initializ auth whoami -o json

{
  "valid": true,
  "user_id": "usr_9f8e7d",
  "org_id": "org_a1b2c3",
  "email": "ci-bot@acme.com",
  "workspace_id": "ws_a1b2c3de",
  "error": ""
}

Preflight pattern for pipelines

# Fails the job early (exit 3) if the token is invalid or was revoked.
initializ auth whoami

initializ agent deploy -f initializ-deploy.yaml --image "$IMAGE" --wait