Auth Commands

Manage authentication for Treasure AI. Supports both browser-based OAuth and API key authentication.

Commands

tdx auth                    # Show authentication status
tdx auth status             # Alias for tdx auth
tdx auth setup              # Setup authentication interactively
tdx auth token              # Print the OAuth access token
tdx auth clear              # Remove credentials from system keychain

Auth Status

Display current authentication status and validate credentials:

tdx auth
tdx auth --profile prod

Shows the active profile, credential type (OAuth or API key), and validates by calling the TD API.

Auth Setup

Interactive authentication setup. Choose between browser-based OAuth (recommended) or API key:

tdx auth setup
tdx auth setup --site ap01
tdx auth setup --profile prod
tdx auth setup --account-name td7060   # SSO login for a specific account

Browser Sign-in (OAuth)

1. Select your Treasure AI site
2. Choose "Sign in with browser"
3. Optionally enter an account name for SSO routing
4. Browser opens for authentication
5. After login, tokens are saved to system keychain

OAuth tokens are stored securely in the system keychain and used automatically for subsequent commands.

TIP

OAuth opens a local callback server on 127.0.0.1:43594 to receive the authorization response. The server times out after 2 minutes.

API Key

1. Select your Treasure AI site
2. Choose "Use an API key"
3. Enter your API key (found at Console > API Keys)
4. Key is validated and saved to system keychain

Auth Token

tdx auth token prints only the raw OAuth access token followed by a newline. It is intended for tools that support command-based bearer authentication, such as Codex. The command does not print status messages on stdout; errors are written to stderr.

tdx auth token
tdx auth token --profile production

The command reads environment credentials before keychain credentials, and skips the saved keychain credential when a matching environment credential is set. Keychain OAuth credentials are refreshed when they are expired or within five minutes of expiry, and refreshed credentials are saved back to the system keychain. API keys are not printed or treated as bearer tokens.

In the rare case that the stored token is known-expired and the keychain has no refresh token to renew it with — a corrupted or partially initialized entry — the command exits non-zero with UNAUTHENTICATED instead of printing a stale bearer, and points you at tdx auth setup. This is not something a normal tdx auth setup flow leaves behind. Legacy keychain entries written before token-expiry tracking existed are accepted as-is.

Auth Clear

Remove all credentials (API key and OAuth tokens) from the system keychain:

tdx auth clear
tdx auth clear --profile prod

Options

Option	Description
--site <site>	Target site (us01, ap01, eu01, ap02)
--profile <name>	Profile to use
--account-name <name>	Account name for SSO login (auth setup only)

Environment Variables

Variable	Description
TDX_ACCESS_TOKEN	Access token for Bearer authentication
TDX_ACCESS_TOKEN_<PROFILE>	Profile-specific access token
TDX_ACCESS_TOKEN_FILE	File containing an access token
TDX_API_KEY	API key for TD1 authentication
TDX_API_KEY_<PROFILE>	Profile-specific API key
TD_OAUTH_CLIENT_ID	Override OAuth client ID (default: tdx)

When TDX_PROFILE is set, TDX_ACCESS_TOKEN, TDX_ACCESS_TOKEN_FILE, and TDX_API_KEY apply only to that profile. Selecting another profile with --profile uses that profile's own _<PROFILE> variables or keychain credential.