Console & Browser Login
Authorize the terminal from the browser, or paste a scoped token in headless environments.
- Browser device flow with short pairing code
- Fallback URL when the browser cannot open
- Organization scope chosen at authorization time
- Headless path: SECRETOPS_APP_TOKEN or scoped token
- CLI tokens expire minutes after authorization
- Access summary printed on successful login
What it looks like
cybsecrets login offers two paths: an interactive device flow that opens the browser with a short-lived pairing code, or a direct scoped API token for CI and headless machines. Either way the CLI only ever sees what the credential is allowed to see.
Authorize from the browser
The terminal prints a pairing code and opens the SecretOps console. You confirm the device, pick the organization scope and authorize — the terminal receives a short-lived token, never your password.
Scoped tokens for CI
Answer no to the browser prompt and the CLI accepts a SECRETOPS_APP_TOKEN or any scoped token. Build agents get exactly one app and one environment.
Minutes, not months
CLI tokens expire shortly after authorization and organization scope is chosen per session, so a leaked terminal token is worth almost nothing.